Extracted

• • Target

    JaffaCakes118_b564c3b0f466e033b49e333af04b32c8

  • Size

    304KB

  • MD5

    b564c3b0f466e033b49e333af04b32c8

  • SHA1

    7f011ef05e25447a69eac5842b9d5fc361a8b2dc

  • SHA256

    f97b83d488061c68f1255def1e961b254ed9794a9565ac4a3ca158bebcd46801

  • SHA512

    cdf56144f8f7d6da635c834215112c87f6b635cf304cd12f3c60ff14810fc6085e769af2b59c4366fbf58e4b1a5efb9b29a63ea825d5cc4f807c3d55064c6d5d

  • SSDEEP

    6144:cSqjc3HsTaxoqzj25GvaEs5k7nDsAAVpGq1JAjWnnvpF:cOyaiqnYGfUkXDAKGJuWv7

  Score

  10^/10

  ramnitsalitybackdoorbankerdefense_evasiondiscoveryspywarestealertrojanupxworm

  • Modifies firewall policy service

    defense_evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1