Extracted

• • Target

    b9219624eddd068493d7e0cf234378bdfe9dd88baf2daf2cdd45f9039be8596fN.exe

  • Size

    887KB

  • MD5

    b65bee1e569efe298d1de66470853150

  • SHA1

    3d87211cbe5698d600a9b51ac65682c13e6d7c7c

  • SHA256

    b9219624eddd068493d7e0cf234378bdfe9dd88baf2daf2cdd45f9039be8596f

  • SHA512

    963371fa86306cb72a4499de9f831021b2c705c1292ae2a5a7f0e0d61a80354b1116c059eaeab7209bb163ac6db5b3c8edba43a8e293702b05050984204894cc

  • SSDEEP

    24576:Uzb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwPZnPwCDmM:UzbKsUmjtcdPGgIwPBwRM

  Score

  10^/10

  ramnitsalitybackdoorbankerdiscoveryevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Disables RegEdit via registry modification

    evasion

  • Disables Task Manager via registry modification

    evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2