ramnit | 37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386 | Triage

Submit
Reports

Overview

overview

Static

static

8

37710667fa...86.exe

windows7_x64

37710667fa...86.exe

windows10-2004_x64

Sharing

General

Target

37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386
Size

671KB
Sample

220625-3a2nragafj
MD5

8dcfff56d0b34464094de71253e91a48
SHA1

2a7a9c5c740b77f3749736b014ae1e05779d9093
SHA256

37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386
SHA512

bcfc7ca758dbd5b3075e221b26faba7a6f2958f1f84fbacf387baa8f7898de5be3a58f9c415578f7f928b86581652007ca9666417bbbe3d8dbcebeea585b628b

Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386.exe

Resource

win7-20220414-en

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386.exe

Resource

win10v2004-20220414-en

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

windows10-2004_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386
- Size
  
  671KB
- MD5
  
  8dcfff56d0b34464094de71253e91a48
- SHA1
  
  2a7a9c5c740b77f3749736b014ae1e05779d9093
- SHA256
  
  37710667fa165d6189de310f56128f1dbd497f56607e06ec41d813190e1c1386
- SHA512
  
  bcfc7ca758dbd5b3075e221b26faba7a6f2958f1f84fbacf387baa8f7898de5be3a58f9c415578f7f928b86581652007ca9666417bbbe3d8dbcebeea585b628b
Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops file in Drivers directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

behavioral2

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy