ramnit

General

Target

be413a561c1b88cc735d4968bacb9c1f08db566ecf08af7dbaa9e3315a449c93
Size

184KB
Sample

221122-1jt9xsaa77
MD5

7d623ac9e2b9b62a6102ab7404ca1103
SHA1

a578804fef2a1e77ca9ce493f1f3a14a58608c3f
SHA256

be413a561c1b88cc735d4968bacb9c1f08db566ecf08af7dbaa9e3315a449c93
SHA512

bc6784fa7d87f32033acb0ed8199810f9e93d74b08dce4be86a7beaa8812cdf78ecfd889acee8e59206cb832bbbce7b0af6e07469cf6ce8f68653744893cd6ad
SSDEEP

3072:JIx0Hc0clgOJLCxk93L6poqkVQ/jsveUHqL+Q77m90fewJzw/nmnXoYdT:JI/xgoWcbEolVWsm1LH/ZZzwmnL

Score

10^/10

Malware Config

Targets

- Target
  
  be413a561c1b88cc735d4968bacb9c1f08db566ecf08af7dbaa9e3315a449c93
- Size
  
  184KB
- MD5
  
  7d623ac9e2b9b62a6102ab7404ca1103
- SHA1
  
  a578804fef2a1e77ca9ce493f1f3a14a58608c3f
- SHA256
  
  be413a561c1b88cc735d4968bacb9c1f08db566ecf08af7dbaa9e3315a449c93
- SHA512
  
  bc6784fa7d87f32033acb0ed8199810f9e93d74b08dce4be86a7beaa8812cdf78ecfd889acee8e59206cb832bbbce7b0af6e07469cf6ce8f68653744893cd6ad
- SSDEEP
  
  3072:JIx0Hc0clgOJLCxk93L6poqkVQ/jsveUHqL+Q77m90fewJzw/nmnXoYdT:JI/xgoWcbEolVWsm1LH/ZZzwmnL
Score

10^/10

ramnit banker persistence ransomware spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2