ramnit | 5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f | Triage

Submit
Reports

Overview

overview

Static

static

5e2d1f6f26...7f.dll

windows7-x64

5e2d1f6f26...7f.dll

windows10-2004-x64

Sharing

General

Target

5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f
Size

876KB
Sample

221123-vrtqgacg2v
MD5

57c9d8fe23f8940f2adf63544e5cab34
SHA1

15a8a06fb1f753f090eb3863f931ffd3c5d78daf
SHA256

5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f
SHA512

97f9a998901cc5dee1cb0735d0f46064dfd28297e9b1656708b10761aa82d3fc49892cc0c443450df481c3b1c952662cdf33c705d7bedfa306aeb85e6af48587
SSDEEP

12288:UPTv+CFW4hPdahP/RN2kU7fWS36pweWGJr619QV4qqxEnEk3D6qC5UjuEOTRPa94:UPSH4hQP/RN2fLqNK9QV4qBH1AM94

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll

Resource

win7-20221111-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f.dll

Resource

win10v2004-20221111-en

ramnit banker evasion spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f
- Size
  
  876KB
- MD5
  
  57c9d8fe23f8940f2adf63544e5cab34
- SHA1
  
  15a8a06fb1f753f090eb3863f931ffd3c5d78daf
- SHA256
  
  5e2d1f6f2603fc4d102b0851cd5a80b05e124a73bf551214b92a940e6204927f
- SHA512
  
  97f9a998901cc5dee1cb0735d0f46064dfd28297e9b1656708b10761aa82d3fc49892cc0c443450df481c3b1c952662cdf33c705d7bedfa306aeb85e6af48587
- SSDEEP
  
  12288:UPTv+CFW4hPdahP/RN2kU7fWS36pweWGJr619QV4qqxEnEk3D6qC5UjuEOTRPa94:UPSH4hQP/RN2fLqNK9QV4qBH1AM94
Score

10^/10

ramnit banker spyware stealer trojan upx worm evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerevasionspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy