Extracted

• • Target

    9137c16cb0d4978645b3d1c6d7447855_JaffaCakes118

  • Size

    224KB

  • MD5

    9137c16cb0d4978645b3d1c6d7447855

  • SHA1

    4a2417e0ec9d5fe4ad031c085468a42db01f9cdd

  • SHA256

    aaabdb1c19000555691476d0e84fee88edae1055fc779f65accbd8bb66e468c8

  • SHA512

    219d9aa576d397b67067a399b261b483e16f279810edfcdf2ee8d17a9222758bdb73fef73cad4d95e73a326e2bdc4cb338409192f4a18962d8c88db88b17b4ad

  • SSDEEP

    3072:nGd5SXclHLA217rTPrU3Ri7nALg36Go859WtgvrBzFT:Gd5Xh3TYhi/oCDT

  Score

  10^/10

  discoveryramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2