Extracted

• • Target

    6d32dfe6f6fd4b5bfb4269bcbc6685b39d12d96fd77b862c981da01243469edb.exe

  • Size

    716KB

  • MD5

    0fd8dfe492b9ddd2491d3e59d8fd8fb8

  • SHA1

    69dc45799b9b733937b3c3d271406b6d8a19630c

  • SHA256

    6d32dfe6f6fd4b5bfb4269bcbc6685b39d12d96fd77b862c981da01243469edb

  • SHA512

    407a85603880d3d6ce67c80e785239c92df7035d4b64007f1210e70df2d0a5a52d12e94534a7c59cf461c0c3d50511ecc4b14fe550c79098dd86d3e47fcbe5ab

  • SSDEEP

    12288:9Hg3POWGRghDRUi/KsDj+Ea/TjOebZ3f2yeDOUCVh7XLvd/:9HAOr2/jcbyAZfzv7t

  Score

  10^/10

  ramnitsalitybackdoorbankerdefense_evasiondiscoveryspywarestealertrojanupxworm

  • Modifies firewall policy service

    defense_evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2