Overview

overview

10

Static

static

hxjyxichao...??.exe

windows7-x64

10

hxjyxichao...??.exe

windows10-2004-x64

10

hxjyxichao...??.url

windows7-x64

6

hxjyxichao...??.url

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    537b464463db98847e22ff6a54a743a5b18936ae70fb3ce30b68fd99608fc925

  • Size

    1.7MB

  • Sample

    220716-3rjt9sfcb8

  • MD5

    61718ad0ee107ae9a5c86b5db779d2f9

  • SHA1

    f9017f8eaacdeb57c1a20ca0e676ae2fa4a5a594

  • SHA256

    537b464463db98847e22ff6a54a743a5b18936ae70fb3ce30b68fd99608fc925

  • SHA512

    bdb3835c58863bc6f5f6894bd12fb3238332f0c9e1cd3800d594e770e35962197746e03f7aa466f48202a0b8df70c1fcaf4a4b80d8d009596e838cb76db9f6ce

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      hxjyxichaofz_fr/4399????????V0.0.1???/4399????????V0.0.1???.exe

    • Size

      2.8MB

    • MD5

      9c0f64ecb81964a02ef3bca47cae0512

    • SHA1

      97251897685aef198daf28540e94d9174be86a83

    • SHA256

      e2fbbe0e594af10e363af9ee0356ee5051a62a96bf56d85e83a37cd380e7c9a0

    • SHA512

      2a4bf49866cb4f64dfb538afd753e439f2b6a9a5e04075cfd8150899be5af2425f877eb209760e18551f97df07182accda9e2b97d5186444ec5bce5bab5847b3

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      hxjyxichaofz_fr/4399????????V0.0.1???/??????.url

    • Size

      219B

    • MD5

      122e953f3a92541c27cc62db2d9bb0f7

    • SHA1

      5c85d98b4bce0daac9631297ddb00b005161d131

    • SHA256

      5bf9390d32df4da5ddb91425fc5002768a85305964a8e0cb8eda391b4b6511dd

    • SHA512

      77240964186d2e9c9c73ed6bf13edccaeb40c0d8cbf477080c9a40a76d044964330e97421e4b45818bfbb2688e6bfaf6720a52f2efdd3b944f3624b1b5767583

    Score
    6/10
    evasiontrojanpersistence
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks