Overview

overview

10

Static

static

5

d58482d9af...66.exe

windows7_x64

10

d58482d9af...66.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d58482d9af4f9b69008295ba2684f0b249a699162e44319a74cab4cba3a77266

  • Size

    3.3MB

  • Sample

    220525-bfy19shecl

  • MD5

    29ec167f930bbf8256a66463872ff525

  • SHA1

    4acb67568804342520d71aed66d3d4fc0feac49e

  • SHA256

    d58482d9af4f9b69008295ba2684f0b249a699162e44319a74cab4cba3a77266

  • SHA512

    63c1418dd42618f84d68c3fb74356f97f94b1734ee4e28df63dae1632b8a16eef120017070e824ff496aca11ebade6636f6fa7ef52481a3fba258d9005a3886b

Score
10/10
ramnitbankerbootkitdiscoveryevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      d58482d9af4f9b69008295ba2684f0b249a699162e44319a74cab4cba3a77266

    • Size

      3.3MB

    • MD5

      29ec167f930bbf8256a66463872ff525

    • SHA1

      4acb67568804342520d71aed66d3d4fc0feac49e

    • SHA256

      d58482d9af4f9b69008295ba2684f0b249a699162e44319a74cab4cba3a77266

    • SHA512

      63c1418dd42618f84d68c3fb74356f97f94b1734ee4e28df63dae1632b8a16eef120017070e824ff496aca11ebade6636f6fa7ef52481a3fba258d9005a3886b

    Score
    10/10
    ramnitbankerbootkitdiscoveryevasionpersistencespywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks