Extracted

• • Target

    90c0699438847c2ccf41e8ce2f9783a3_JaffaCakes118

  • Size

    564KB

  • MD5

    90c0699438847c2ccf41e8ce2f9783a3

  • SHA1

    7b9e225429a2f2970eea3a00b1a6467a58341f76

  • SHA256

    97c2223fee7432588205715ada347b94ffbaa4b1692d38e4ac2efeb7d4617fa5

  • SHA512

    8ef707d155946272898e4dae0b914aae34db02bec10c80f1e9bd0c677c87b3133cf4c4feadce242a8bc256c74fe5f18bba55ec359e8806e9e62b42bf5c9fd87f

  • SSDEEP

    12288:bXo450qjYthuCNIm/kqF6a2FjyHIDiI4Ov1yNbzAFLZjFv:y/ku6FjyHel4Ov1ymP5

  Score

  10^/10

  discoveryramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2