Overview

overview

10

Static

static

8

tmp/564217...60.exe

windows7_x64

10

tmp/564217...60.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/56421701-a10c-4568-97b5-9cd5b93ba2bd_s360.exe

  • Size

    103KB

  • Sample

    211222-vh1sesffg3

  • MD5

    f9f8bd253aaa0d8db48a4ee87c6c4347

  • SHA1

    80b07d19bab1533b76d17d78df9685f868fa0923

  • SHA256

    1f78163d063ace048590769c4edec4771fedc1ac2a5bd9d51241824ef5f5ac04

  • SHA512

    5deaae37227a29f228a3cb85e2c0b81975ff6715161231adadcc397859a81610699b2bd7028538a3ce05874fb74c0e9c4fac4a84f674bcc2235797030c0df8b7

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      tmp/56421701-a10c-4568-97b5-9cd5b93ba2bd_s360.exe

    • Size

      103KB

    • MD5

      f9f8bd253aaa0d8db48a4ee87c6c4347

    • SHA1

      80b07d19bab1533b76d17d78df9685f868fa0923

    • SHA256

      1f78163d063ace048590769c4edec4771fedc1ac2a5bd9d51241824ef5f5ac04

    • SHA512

      5deaae37227a29f228a3cb85e2c0b81975ff6715161231adadcc397859a81610699b2bd7028538a3ce05874fb74c0e9c4fac4a84f674bcc2235797030c0df8b7

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks