Overview

overview

10

Static

static

snxdx/????.url

windows7_x64

6

snxdx/????.url

windows10-2004_x64

6

snxdx/?????.exe

windows7_x64

1

snxdx/?????.exe

windows10-2004_x64

1

snxdx/??????.url

windows7_x64

6

snxdx/??????.url

windows10-2004_x64

6

snxdx/Crac...PI.dll

windows7_x64

10

snxdx/Crac...PI.dll

windows10-2004_x64

10

snxdx/UUWi...er.dll

windows7_x64

1

snxdx/UUWi...er.dll

windows10-2004_x64

3

snxdx/dc.dll

windows7_x64

8

snxdx/dc.dll

windows10-2004_x64

8

snxdx/msvcr120.dll

windows7_x64

3

snxdx/msvcr120.dll

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    caaf7a0ba0be857a3b9ffadb1721a2f8e1ce053de3e54c58971c24235acb8952

  • Size

    1.5MB

  • Sample

    220520-en4s9sbhcl

  • MD5

    f3acc27bd7913fc5e6bc6f59b1d0efeb

  • SHA1

    2803285418877ce0baa181ea4d82e90777975c5e

  • SHA256

    caaf7a0ba0be857a3b9ffadb1721a2f8e1ce053de3e54c58971c24235acb8952

  • SHA512

    b66ef1dbeb2b69b8a994d105f8eba9d4f80bce758b9bdeb8e6ea76413f388d38ebbf1eca24864a2e1c84b0aafb244d727eab0d5744fc5d3e9df6d20f848b4b1f

Score
10/10
ramnitbankerbootkitevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      snxdx/????.url

    • Size

      125B

    • MD5

      379cd9bc5f7937f7414191c65d8a4979

    • SHA1

      e0fb340fe107b422f33439512016e68eca29b03d

    • SHA256

      42c63721e8fad25c6454683e82365a3ceb55a4e520b7b15fe8ec022b3db3fc2b

    • SHA512

      f0ce028625e6791c1ca729cf9966516f6c67bfcc40eff50f7c804c5da88a13aac4a55541d47e5adaad3672f8702288ef1b592fb47c335da5be401cc8c6a13d00

    Score
    6/10
    evasiontrojanpersistence
    behavioral1behavioral2

    • Target

      snxdx/?????.exe

    • Size

      74KB

    • MD5

      2eab259424f6d41b2ae46343f34ffb3d

    • SHA1

      2c1b3d849074ec953be2740db933886e4a86d164

    • SHA256

      7f0309078b3bda7137d13984587d28e6a36675a4381039f26c52052bef9c3770

    • SHA512

      6e56eea55b159fe7564d78fd23a9a69787203e4a2b3be001ad5c141633c192ddc2bf536461f34651900fb5fd41b2e75543a0f73cc90e2bc97526d6223fb12343

    Score
    1/10
    behavioral3behavioral4

    • Target

      snxdx/??????.url

    • Size

      325B

    • MD5

      c7728418b7817af20083617d2a7bde97

    • SHA1

      f8cac36816b472018d97e97485e92ee5d7bd4b24

    • SHA256

      d31d7893e0cfd730022933decbcc420c1169c2715ffecb804ba685f30b99df80

    • SHA512

      ff30d9bf14ff78eb3080c5e07aecf3d60827833c475ae6c96ed5f4217ecc2a9a25d1e3c0aa4fee5950cccd2601cd10f4f0c2e8428bfc5795c7c3438455621c21

    Score
    6/10
    evasiontrojanpersistence
    behavioral5behavioral6

    • Target

      snxdx/CrackCaptchaAPI.dll

    • Size

      1.4MB

    • MD5

      803ff1fcf41f190b29838246f6f7615c

    • SHA1

      3256620504b7694a98e65c8bb8bad6550035ba66

    • SHA256

      79e965deb85ecd372dbbb5fd9c77867bcb4d5ad6e0c124ccc3ee51358305214d

    • SHA512

      e18b8af2cc617558d248db9d33cd6f10ba27bff9a6dd3ae08acfff21e9f1e7e7966a078c56e939c13e79c7621e37ab1502a73b1292b040133008313d2e19b216

    Score
    10/10
    ramnitbankerbootkitpersistencespywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral7behavioral8

    • Target

      snxdx/UUWiseHelper.dll

    • Size

      228KB

    • MD5

      7c0415db33190179697196004e57d7c4

    • SHA1

      08490854f84d7a8034a6945ff146d4862b15b5a7

    • SHA256

      aa058b89e25c14072acfac4f9159b7d74b20955e3940088e1037d87ca90d9ec1

    • SHA512

      dfd070b4ac5686510251be2564af7cc361246234808b0cb6537ea80e0d3717c061f90c0d4044c7e16d5d875def730ed0ed56ba3d4f7dd580dbdf9e7aab7dd1b7

    Score
    3/10
    behavioral9behavioral10

    • Target

      snxdx/dc.dll

    • Size

      112KB

    • MD5

      3a7c7fb54091111e3ed61720e2c3099e

    • SHA1

      c6bae31d03e2ef65145f7e9cbbcf93213893f49a

    • SHA256

      2de070429883532cc23061bcec1dc2b05c9e57ddec7b28ed14499e8829c9ca8e

    • SHA512

      54739aeb81fdcb0608d6a8579f2fa478d75a1908e2ff115bab91062977470361b142854153970de5333f2f106eb86c07aaeb9956928866aefed41b7c1a803f67

    Score
    8/10

    • Blocklisted process makes network request

    behavioral11behavioral12

    • Target

      snxdx/msvcr120.dll

    • Size

      948KB

    • MD5

      034ccadc1c073e4216e9466b720f9849

    • SHA1

      f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    • SHA256

      86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    • SHA512

      5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

    Score
    3/10
    behavioral13behavioral14

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

6
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks