ramnit

General

Target

559a0c77c733d6206a2f3b3f4748a10182634b207f5ad1b30fa66bdb3d025059
Size

1.2MB
Sample

221028-y15e4sdgg2
MD5

0b0abebcf52608a0a662c17f3bd316d0
SHA1

107c457ae440d137e5735244871f8e8f3998e6e1
SHA256

559a0c77c733d6206a2f3b3f4748a10182634b207f5ad1b30fa66bdb3d025059
SHA512

0f96fbbf4b502f7e5dfb187091a070d0acca5c182ef741210eaf3dbd9e24388fbeb0f9be0e80270eb8fdb71f48d23137771b6ef95d1f3ebf20d640f5ec13b7db
SSDEEP

24576:EdsuNOCN8loXWfgLYeuQaTjCdsyYPDsseHtHwKlK7MMMMMMRxAyTSiU:nuY28SUgLYosT1MMMMMMhTSd

Score

10^/10

Malware Config

Targets

- Target
  
  559a0c77c733d6206a2f3b3f4748a10182634b207f5ad1b30fa66bdb3d025059
- Size
  
  1.2MB
- MD5
  
  0b0abebcf52608a0a662c17f3bd316d0
- SHA1
  
  107c457ae440d137e5735244871f8e8f3998e6e1
- SHA256
  
  559a0c77c733d6206a2f3b3f4748a10182634b207f5ad1b30fa66bdb3d025059
- SHA512
  
  0f96fbbf4b502f7e5dfb187091a070d0acca5c182ef741210eaf3dbd9e24388fbeb0f9be0e80270eb8fdb71f48d23137771b6ef95d1f3ebf20d640f5ec13b7db
- SSDEEP
  
  24576:EdsuNOCN8loXWfgLYeuQaTjCdsyYPDsseHtHwKlK7MMMMMMRxAyTSiU:nuY28SUgLYosT1MMMMMMhTSd
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies system executable filetype association
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies WinLogon for persistence

Modifies system executable filetype association

Executes dropped EXE

UPX packed file

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2