Overview

overview

10

Static

static

8

4b75a20066...f2.exe

windows7_x64

10

4b75a20066...f2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

  • Size

    124KB

  • Sample

    220712-lwazgsfga4

  • MD5

    c6ce21c4c9389a23d6deac23d9d43190

  • SHA1

    36036d346993df07681926111f73891dd8f19846

  • SHA256

    4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

  • SHA512

    fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

Score
10/10
ramnitaspackv2bankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

    • Size

      124KB

    • MD5

      c6ce21c4c9389a23d6deac23d9d43190

    • SHA1

      36036d346993df07681926111f73891dd8f19846

    • SHA256

      4b75a200664d5e43fb297347fd6f93e8f8685320bd1959c5b07f3c597918c8f2

    • SHA512

      fa90bc5a6d1753ae08ee384c6e7d333da416f166edc4b72b605029a01d636773e728743c86d547413e4a9bcd8ea40ddf3d89588c3aca747d20dd9575f2d2110f

    Score
    10/10
    ramnitaspackv2bankerpersistencespywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Creates a Windows Service

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks