Extracted

• • Target

    c8a07422a4f79aa726f12eb9f2a47f850e7821f9a31a0b28ff70234769af9605N.exe

  • Size

    716KB

  • MD5

    a224ab583afbe09930703315db00d6a0

  • SHA1

    70dedfdb31ea49b113bc4db583ababbbd88831ec

  • SHA256

    c8a07422a4f79aa726f12eb9f2a47f850e7821f9a31a0b28ff70234769af9605

  • SHA512

    0c7c41f3ef00625b46f672f6952737f7011a1e69fdebc785f99b7baeb57177b66511a45289cd7821080183e87eeaf504a1de5ae4e7cadba9562b16048ad8670a

  • SSDEEP

    12288:9Hg3POWGRghDRUi/KsDj+Ea/TjOebZ3f2yeDOUCVh7XLvd:9HAOr2/jcbyAZfzv7

  Score

  10^/10

  ramnitsalitybackdoorbankerdefense_evasiondiscoveryspywarestealertrojanupxworm

  • Modifies firewall policy service

    defense_evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2