Extracted

• • Target

    JaffaCakes118_b834b02395c45cfebf66feee71e69937

  • Size

    183KB

  • MD5

    b834b02395c45cfebf66feee71e69937

  • SHA1

    2147347d2298d10dbd8027bc8c2929ce4de0dc96

  • SHA256

    5325b4efec8e57cf32e4f3bf970c4d02ab8217b3ba7ec0012345fb85e6204a08

  • SHA512

    3d8b4b06bff156af43693bf1a54f174022e9330d3a84d61015910217f049be92ef145a674c509a88b140a1c1770a6b913d84f84b2698657c1ce92467c72c0746

  • SSDEEP

    3072:tEprNRRGHaK0cc89rKU06/2raIsVbELf4MK9NmGFcwkkgGfdZgXRxf8U8bgNAc:IrNoj0A9ye2raIRPKfmGq1aZgXrGbgND

  Score

  10^/10

  ramnitsalitybackdoorbankerdefense_evasiondiscoveryspywarestealertrojanupxworm

  • Modifies firewall policy service

    defense_evasion

  • Ramnit

    Ramnit is a versatile family that holds viruses, worms, and Trojans.

    trojanspywarestealerwormbankerramnit

  • Ramnit family

    ramnit

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1