Overview

overview

10

Static

static

18599eb63c...de.dll

windows7_x64

10

18599eb63c...de.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    18599eb63c03a352b0dbfaf683e525728e059794ced576ab55a4c01c14d99ede

  • Size

    2.8MB

  • Sample

    210515-2nsnm8ha8e

  • MD5

    971240940e46d9d01baaa0bd108cd1bf

  • SHA1

    cf6463bfed04b36ce2ec27083117d7335c04a315

  • SHA256

    18599eb63c03a352b0dbfaf683e525728e059794ced576ab55a4c01c14d99ede

  • SHA512

    0896a43ee4e0d0955e2d9d9edab3fe49a3779d632e839ccf31965bee300d9913deee3c03cce4281e20742b158d8b2d333eef4af2ecfa931ecaf4dc319ec295a5

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      18599eb63c03a352b0dbfaf683e525728e059794ced576ab55a4c01c14d99ede

    • Size

      2.8MB

    • MD5

      971240940e46d9d01baaa0bd108cd1bf

    • SHA1

      cf6463bfed04b36ce2ec27083117d7335c04a315

    • SHA256

      18599eb63c03a352b0dbfaf683e525728e059794ced576ab55a4c01c14d99ede

    • SHA512

      0896a43ee4e0d0955e2d9d9edab3fe49a3779d632e839ccf31965bee300d9913deee3c03cce4281e20742b158d8b2d333eef4af2ecfa931ecaf4dc319ec295a5

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks