ramnit | 5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

5317ba6bbb...21.exe

windows7-x64

5317ba6bbb...21.exe

windows10-2004-x64

Sharing

General

Target

5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21
Size

233KB
Sample

221030-1tb64acda4
MD5

a1999f284061bd71d2ad80ea2032d610
SHA1

241a45ab4efc17e5401b6e6253359bfd4e736ad7
SHA256

5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21
SHA512

606a8fbcac071dbd54287f21cdb1cb214d14a7b069f77e4140f6db717f07c4b967ac313033d248db0b382fd8f449b58e53cbcc7a345d3056719dde376a5709b4
SSDEEP

3072:H+FDmK71QkbstyJjCKICpC72s/mlaXrXhFaxmYoKJpgrbJhMJxktjEE:H+T713bstyJj0sC7/HrXWxuuEJ1n

Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21.exe

Resource

win7-20220901-en

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21.exe

Resource

win10v2004-20220812-en

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21
- Size
  
  233KB
- MD5
  
  a1999f284061bd71d2ad80ea2032d610
- SHA1
  
  241a45ab4efc17e5401b6e6253359bfd4e736ad7
- SHA256
  
  5317ba6bbbcf285e40f23365ae9fc8ef162cc7b1c187a1ad1d96922ff7ec7c21
- SHA512
  
  606a8fbcac071dbd54287f21cdb1cb214d14a7b069f77e4140f6db717f07c4b967ac313033d248db0b382fd8f449b58e53cbcc7a345d3056719dde376a5709b4
- SSDEEP
  
  3072:H+FDmK71QkbstyJjCKICpC72s/mlaXrXhFaxmYoKJpgrbJhMJxktjEE:H+T713bstyJj0sC7/HrXWxuuEJ1n
Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

behavioral2

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy