Overview

overview

10

Static

static

cae6b4e39b...07.exe

windows7_x64

10

cae6b4e39b...07.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cae6b4e39ba4d063f5cba8661273f32c02220cbb462a7588b5b47e7b50da5207

  • Size

    339KB

  • Sample

    210515-w3zqjcgjcs

  • MD5

    3e628e1e2058f245977a30bf45a665f0

  • SHA1

    d029f681a32c8d9cb47e896ebf1c5e0bd5404742

  • SHA256

    cae6b4e39ba4d063f5cba8661273f32c02220cbb462a7588b5b47e7b50da5207

  • SHA512

    5e352dc7f353094980152e3e9af2564b6b6c121b68268334fd9c8c4a9f50cdfda342025e5602be525266fe0cb2eb30bfac25d69c745a9be76e1a636834044cc7

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      cae6b4e39ba4d063f5cba8661273f32c02220cbb462a7588b5b47e7b50da5207

    • Size

      339KB

    • MD5

      3e628e1e2058f245977a30bf45a665f0

    • SHA1

      d029f681a32c8d9cb47e896ebf1c5e0bd5404742

    • SHA256

      cae6b4e39ba4d063f5cba8661273f32c02220cbb462a7588b5b47e7b50da5207

    • SHA512

      5e352dc7f353094980152e3e9af2564b6b6c121b68268334fd9c8c4a9f50cdfda342025e5602be525266fe0cb2eb30bfac25d69c745a9be76e1a636834044cc7

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasion

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks