Extracted

• • Target

    08e9067aa07ac4de151ec8ce01734ccd3956d69da45bc6c34cc0b4c6483b0d9c.exe

  • Size

    377KB

  • MD5

    4824f9b622937d5fefa8a159615fe300

  • SHA1

    bfe07cd25385e7aa1f293f4eae7f32d63ec53846

  • SHA256

    08e9067aa07ac4de151ec8ce01734ccd3956d69da45bc6c34cc0b4c6483b0d9c

  • SHA512

    f1aca323b49e78f2025fbc613ccf708aab8552ab658f75ac020e4ff6ff240b5f5bc9e7c7583d268157d6565a821515660227393d8c5cc6337811b5e45d4ddec6

  • SSDEEP

    6144:sxGMku94XCzTurXzURlbDC9K69u2m+SqOWcsQQKiY4leDDGoggH/VREG6j4Gm01l:sxGCOXzURlbDC9K69u2m+SqOWcsQQKi9

  Score

  10^/10

  ramnitsalitybackdoorbankerdiscoveryevasionspywarestealertrojanupxworm

  • Modifies firewall policy service

    evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2