Overview

overview

10

Static

static

71834849cc...ca.exe

windows7-x64

10

71834849cc...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca

  • Size

    816KB

  • Sample

    221123-z7bl2sef48

  • MD5

    595bcf0e9eda86a1625dcd4bc61d3257

  • SHA1

    f9aef65ee80a7837d7db6794c8285f99107e62fe

  • SHA256

    71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca

  • SHA512

    d9db455af3e4baf9d6c1760636fda674ccdedd14f2b014d66ff79bd5513db2f94f934f13ecb2563907bb187f02d3fe4a56be66c4c836209e7e6347a2bca9b889

  • SSDEEP

    12288:Rs0AhHtn1bvzSP6iTn1UserksHkU5KrVclb6ajydnlJj/IiLmqU2zYHp7D0xBm:RsdhHLvmP6+19egRG10nlJjp/U20x+s

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca

    • Size

      816KB

    • MD5

      595bcf0e9eda86a1625dcd4bc61d3257

    • SHA1

      f9aef65ee80a7837d7db6794c8285f99107e62fe

    • SHA256

      71834849cc7c27bbb53eb9316833d0c5665f7f7d322e06d0625212daaaa8d8ca

    • SHA512

      d9db455af3e4baf9d6c1760636fda674ccdedd14f2b014d66ff79bd5513db2f94f934f13ecb2563907bb187f02d3fe4a56be66c4c836209e7e6347a2bca9b889

    • SSDEEP

      12288:Rs0AhHtn1bvzSP6iTn1UserksHkU5KrVclb6ajydnlJj/IiLmqU2zYHp7D0xBm:RsdhHLvmP6+19egRG10nlJjp/U20x+s

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasion

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks