ramnit | cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c | Triage

Submit
Reports

Overview

overview

Static

static

cf08a5909b...3c.exe

windows7-x64

cf08a5909b...3c.exe

windows10-2004-x64

Sharing

General

Target

cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c
Size

241KB
Sample

221123-xfvjqseh55
MD5

432e72f8c7c3a6c3fe08bc37c7d05eb1
SHA1

37fe5b4a590d5634b9c426688c014226eccbce4f
SHA256

cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c
SHA512

21e4f8ad5946c4d4817a8d81db919bba7721c547fb06435f0dda8223a26e854666bfedcfd978e80e9ec8c0c4d92bc600822e94e81d03ef6c2a2451062d3608c1
SSDEEP

3072:ynxwgxgfR/DVG7wBpEu/olCccw+Um4i1APz/S1vKic2GL2jAnEAfuGSlyrYI:y+xDVG0Bpvccus187aKXfdSuR

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe

Resource

win7-20220812-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c.exe

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c
- Size
  
  241KB
- MD5
  
  432e72f8c7c3a6c3fe08bc37c7d05eb1
- SHA1
  
  37fe5b4a590d5634b9c426688c014226eccbce4f
- SHA256
  
  cf08a5909b3db8517fbd154d29d88f624f29c277ca282363ad2e4371a076993c
- SHA512
  
  21e4f8ad5946c4d4817a8d81db919bba7721c547fb06435f0dda8223a26e854666bfedcfd978e80e9ec8c0c4d92bc600822e94e81d03ef6c2a2451062d3608c1
- SSDEEP
  
  3072:ynxwgxgfR/DVG7wBpEu/olCccw+Um4i1APz/S1vKic2GL2jAnEAfuGSlyrYI:y+xDVG0Bpvccus187aKXfdSuR
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy