ramnit | 35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd | Triage

Submit
Reports

Overview

overview

Static

static

8

35078d7135...dd.exe

windows7-x64

35078d7135...dd.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd
Size

166KB
Sample

221121-kxlxpscc32
MD5

305a72a0bad0db00046a7475055a11a0
SHA1

9b3af7206b7805647dc3c545e01a35a939e33520
SHA256

35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd
SHA512

c317c75e45b48283f415e8add28409578a8e0403f55923e72218c5ce7c47a8c0316be39d603cca4ce8c58707e081da547bf9d0e0e6ed15b9e56ae97e046acbd7
SSDEEP

3072:32vTIyAjtVTNaPAm51VEa8vSahT1PdSJ9Mj41XqearQLm9S:MI1jPTNQ/Vl6S41SJ7qeiom

Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd.exe

Resource

win7-20221111-en

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd.exe

Resource

win10v2004-20221111-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd
- Size
  
  166KB
- MD5
  
  305a72a0bad0db00046a7475055a11a0
- SHA1
  
  9b3af7206b7805647dc3c545e01a35a939e33520
- SHA256
  
  35078d713537bb55cf4df022c8020aff4bc0aeceb484665d9486fb52f91c72dd
- SHA512
  
  c317c75e45b48283f415e8add28409578a8e0403f55923e72218c5ce7c47a8c0316be39d603cca4ce8c58707e081da547bf9d0e0e6ed15b9e56ae97e046acbd7
- SSDEEP
  
  3072:32vTIyAjtVTNaPAm51VEa8vSahT1PdSJ9Mj41XqearQLm9S:MI1jPTNQ/Vl6S41SJ7qeiom
Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerevasionpersistencespywarestealertrojanupxworm

behavioral2

© 2018-2025

Terms | Privacy