General

  • Target

    26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21

  • Size

    3.6MB

  • Sample

    220616-hwc73agahk

  • MD5

    8ac6048052fe6d058ea3c6b5a386e8c6

  • SHA1

    d1421972e36d14ec459b610eae60f1887d095038

  • SHA256

    26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21

  • SHA512

    90830292633117c2b6990abed881dc39dfeb7cefdb060fda4748fcae3e37a82b20ee2b9fd7e3d6398af345e81c7a7827b52b7738a4e8e574233c5d5aad6918c3

Malware Config

Targets

    • Target

      26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21

    • Size

      3.6MB

    • MD5

      8ac6048052fe6d058ea3c6b5a386e8c6

    • SHA1

      d1421972e36d14ec459b610eae60f1887d095038

    • SHA256

      26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21

    • SHA512

      90830292633117c2b6990abed881dc39dfeb7cefdb060fda4748fcae3e37a82b20ee2b9fd7e3d6398af345e81c7a7827b52b7738a4e8e574233c5d5aad6918c3

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks