Overview

overview

10

Static

static

314082c909...c6.exe

windows7_x64

10

314082c909...c6.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    314082c909a94ccd11372aedfc8f7ccfc00cb234003ff66934d3e517f63a37c6

  • Size

    330KB

  • Sample

    220205-fwttpsgggn

  • MD5

    d3674fb64e76d37df3c1348228bba39c

  • SHA1

    fab2e0855c412f224fb75115a084dc689b1a3dc2

  • SHA256

    314082c909a94ccd11372aedfc8f7ccfc00cb234003ff66934d3e517f63a37c6

  • SHA512

    7285002b30727bb68410c500aea1f8fd359325480b0e4eadbad1d5a88c7b39a8b4d505a56b29a632b3ee4627d4dd7c7fd73bece79da8e78eed4c3a9a546f2b96

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      314082c909a94ccd11372aedfc8f7ccfc00cb234003ff66934d3e517f63a37c6

    • Size

      330KB

    • MD5

      d3674fb64e76d37df3c1348228bba39c

    • SHA1

      fab2e0855c412f224fb75115a084dc689b1a3dc2

    • SHA256

      314082c909a94ccd11372aedfc8f7ccfc00cb234003ff66934d3e517f63a37c6

    • SHA512

      7285002b30727bb68410c500aea1f8fd359325480b0e4eadbad1d5a88c7b39a8b4d505a56b29a632b3ee4627d4dd7c7fd73bece79da8e78eed4c3a9a546f2b96

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormpersistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

3
T1081

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Tasks