Extracted

• • Target

    5039df11110ab9d69eb974fc8f466515fc7f431d8f19b73712675837ffae2eb3.exe

  • Size

    1.3MB

  • MD5

    435ac87156ac9561cc5658b8d70e5828

  • SHA1

    221541c61629aecefa02e63ffb9c4a450fdf4bf9

  • SHA256

    5039df11110ab9d69eb974fc8f466515fc7f431d8f19b73712675837ffae2eb3

  • SHA512

    c367bafda2d8ce7aacb27ef897c07f64fe2a29011d59cb8c45ef14cffbe5d355ce28f9b2d8a3554daeff5d8fff1d85de267fb90c6c2f85bf8638c10cbae1d380

  • SSDEEP

    12288:59g8GZHpzAac5naAd25L5O+FQ7lW8lZ60ICPxaf6og38BfSH6gqrandxT+is3pjq:568+O6pvbt/wuzTB2OFzh8m/1K

  Score

  10^/10

  ramnitsalitybackdoorbankerdiscoveryevasionpersistencespywarestealertrojanupxworm

  • Modifies WinLogon for persistence

    persistence

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2