Extracted

• • Target

    JaffaCakes118_b20f81fb47552c53596f7201fcc6fce5

  • Size

    442KB

  • MD5

    b20f81fb47552c53596f7201fcc6fce5

  • SHA1

    314d7fe009913822751d9595f88def4fe581faa5

  • SHA256

    21d7bdb440170f9f5cd4872de7f91751046d53f0bca086902ef9a1bf0ecc99ee

  • SHA512

    fcfefe5f24cade8c89b7fc0540554c5eeb0b75e06d1261a8ec81ba31eb1ee2b4945a0ba73485a9f6b44288cef31923215c175c1f552ecd0fb52cc66ff08fab09

  • SSDEEP

    6144:G6gI4u6lXnxh65Qr8kxo97piM3LVb0kiP3+7Pl/W9eClX1EZrq:Gq4hxhQQbxS1iMukiP3+U9eCwZrq

  Score

  10^/10

  ramnitsalitybackdoorbankerdefense_evasiondiscoveryspywarestealertrojanupxworm

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1