ramnit | 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3 | Triage

Submit
Reports

Overview

overview

Static

static

8

63592f1efd...e3.exe

windows7-x64

63592f1efd...e3.exe

windows10-2004-x64

Sharing

General

Target

63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3
Size

550KB
Sample

221123-vtrc5ach5x
MD5

444bbc03af7524f7c8d5303d34e34358
SHA1

6cf5d9d49b71e5e614682690b5e1997710a0aec0
SHA256

63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3
SHA512

7d8dd8a915d4ca703ca0cca15351b137263a992216e7775146effe590507eaa8460c9e8bfd0aa19d0ae155981b62413f38e9eb2d83af3db60f7b4587b6392b9c
SSDEEP

12288:2PaYD4dhDccAXN/FDzq/nAKaO7J6eDy2CjkOR1N:2PjDIicyN/5q/2O7JWjnR1N

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe

Resource

win7-20220812-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3
- Size
  
  550KB
- MD5
  
  444bbc03af7524f7c8d5303d34e34358
- SHA1
  
  6cf5d9d49b71e5e614682690b5e1997710a0aec0
- SHA256
  
  63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3
- SHA512
  
  7d8dd8a915d4ca703ca0cca15351b137263a992216e7775146effe590507eaa8460c9e8bfd0aa19d0ae155981b62413f38e9eb2d83af3db60f7b4587b6392b9c
- SSDEEP
  
  12288:2PaYD4dhDccAXN/FDzq/nAKaO7J6eDy2CjkOR1N:2PjDIicyN/5q/2O7JWjnR1N
Score

10^/10

ramnit banker spyware stealer trojan upx worm evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

© 2018-2024

Terms | Privacy