Extracted

• • Target

    e9b24e07bba059b824fa58cf801a2aa7_JaffaCakes118

  • Size

    660KB

  • MD5

    e9b24e07bba059b824fa58cf801a2aa7

  • SHA1

    6a5ffe5471823ac27a1d912c9ab4e59ea331b627

  • SHA256

    d58dd8cb189cda12ad2aa1913b55ed1e2dd596fa702690a60c04db8aa664396b

  • SHA512

    2fb5b065feb03ca416033de18b96116559d4fbe2b14a4ec91d55dee858ba826891af7aa30f22575b69605e33da09deea4b95357fd325da2f3b208ba0cc2d170b

  • SSDEEP

    12288:zZL7A5l0711g8onrOcWAqVvrDhS6kNaW3:zZL7AfYhonSr1naaW3

  Score

  10^/10

  discoveryramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2