Overview

overview

10

Static

static

8

fsMon.dll

windows7-x64

10

fsMon.dll

windows10-2004-x64

10

սʬ....2.exe

windows7-x64

8

սʬ....2.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    452b05891e649f34dcaca8b97b18079d084ecf0999f94d4e4890693900cd99c7

  • Size

    1.3MB

  • Sample

    221124-lg1llaha61

  • MD5

    8df2a62892497d2c2a48b29c1dcfbd6f

  • SHA1

    9dfcc044113dc5b9a064f35325c40c167cb4c9ca

  • SHA256

    452b05891e649f34dcaca8b97b18079d084ecf0999f94d4e4890693900cd99c7

  • SHA512

    7791029cd66d2583692a52f06c95228ed320b670dd1e708d2d488ecc2a1cb4508da5544cf785e78a993fdd83630a2a590c622ecfec626f473e7e8c233ecbf05a

  • SSDEEP

    24576:5DTeIVLZoKsIKSpFAlASSbdAA9q5RlU2NLd+sC+cCU415j//GbjNBkMz2U5f3:FCSo9Aw53t+svcCb5jHMkMz2Up

Score
10/10
ramnitbankerbootkitpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      fsMon.dll

    • Size

      808KB

    • MD5

      1904a88c137c794b52546a215988cf62

    • SHA1

      78dbac34239f8b5103ff705f43b8c1f802f06122

    • SHA256

      dfc1403afce238967024de260e02774da7628dc4afb03d72be3bfa93343af10c

    • SHA512

      6a0cb181f1fcf79ce55eaefb038d38ab2b747a62df980118501fd34d249ff2d0778d8ee13f538c33926bb9127f4d2081bb25dc6ea2d7ec6046123d1d551a28d2

    • SSDEEP

      24576:tNxD6TO4LhtzHcfMqEbn+kZC9AQfCcKBdzIb3cE:T4TXLLHcbe+USo0bs

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      սʬʬɱV2.2.exe

    • Size

      829KB

    • MD5

      e0a867c1368e0a0f7cee9f9304826945

    • SHA1

      f179c0b49d3d3705d99697702ac5383ba018f30a

    • SHA256

      c8b846efff2b4e197a98be1a4dc35117725ee905c0f5b7e22c87183ce67f6dbe

    • SHA512

      ebee0a2f4ad1ee3b042befeb6f5351293fe7c376c2686c7ba0e2de9f5411532f20d0e9886c2254389b5cb51a1dcd75da56d1f61d78bbfe02239ec91fcb5c780e

    • SSDEEP

      24576:Un+GIgqdJeXo7joesIeXE2zp8jvJUKGU99o:7OqdMXcTslE2zpSqKGUv

    Score
    8/10
    bootkitpersistenceupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks