Overview

overview

10

Static

static

8

dab6a6d065...94.exe

windows7_x64

10

dab6a6d065...94.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dab6a6d06595504920e4b8df3ed14906e84b23cf705391a1dc095bcb24155d94

  • Size

    300KB

  • Sample

    210516-wwn3c3wejs

  • MD5

    890fde4a1d65e04af6deb530fc7abb9c

  • SHA1

    b77256ee6cc61e0775a6f44286b43484ee9deeff

  • SHA256

    dab6a6d06595504920e4b8df3ed14906e84b23cf705391a1dc095bcb24155d94

  • SHA512

    231dfc841600a1e8fd8639d4cf838fa3df75a39cc008996b51d2f7ede93a8ae60cabe57957158d635f811c30b27a655104cfe11326cb3c82a89b16699555e44a

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      dab6a6d06595504920e4b8df3ed14906e84b23cf705391a1dc095bcb24155d94

    • Size

      300KB

    • MD5

      890fde4a1d65e04af6deb530fc7abb9c

    • SHA1

      b77256ee6cc61e0775a6f44286b43484ee9deeff

    • SHA256

      dab6a6d06595504920e4b8df3ed14906e84b23cf705391a1dc095bcb24155d94

    • SHA512

      231dfc841600a1e8fd8639d4cf838fa3df75a39cc008996b51d2f7ede93a8ae60cabe57957158d635f811c30b27a655104cfe11326cb3c82a89b16699555e44a

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasion

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Suspicious use of NtCreateProcessExOtherParentProcess

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks