Overview

overview

10

Static

static

e49a4074fb...6c.dll

windows7_x64

10

e49a4074fb...6c.dll

windows10_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e49a4074fbd977573f355c5bf68b4d4cfe31d629868cff01351dab4a12ca146c

  • Size

    116KB

  • Sample

    210509-y63hrcb2ms

  • MD5

    1a1cf5d3a42e57d4b3242b2223016e09

  • SHA1

    2faa59fb1f15baa0351bbe5981900adc4a1942e6

  • SHA256

    e49a4074fbd977573f355c5bf68b4d4cfe31d629868cff01351dab4a12ca146c

  • SHA512

    cf69a3f2618b873cf1000f591ed1d018fb3900429950d4d1b885d24dac6084e0f505150c78235e606b5d75ac9a9514a0dd178205dc397aabfed3320dc62300a7

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      e49a4074fbd977573f355c5bf68b4d4cfe31d629868cff01351dab4a12ca146c

    • Size

      116KB

    • MD5

      1a1cf5d3a42e57d4b3242b2223016e09

    • SHA1

      2faa59fb1f15baa0351bbe5981900adc4a1942e6

    • SHA256

      e49a4074fbd977573f355c5bf68b4d4cfe31d629868cff01351dab4a12ca146c

    • SHA512

      cf69a3f2618b873cf1000f591ed1d018fb3900429950d4d1b885d24dac6084e0f505150c78235e606b5d75ac9a9514a0dd178205dc397aabfed3320dc62300a7

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks