Overview

overview

10

Static

static

1d6c2dfe5d...97.exe

windows7-x64

10

1d6c2dfe5d...97.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1d6c2dfe5d9b0faa88ec4b74ccb7197d41615be0ecddd217b5f242de57016c97

  • Size

    606KB

  • Sample

    221127-ydx3hsdd25

  • MD5

    516f8626b01eab2884836377e0174b8c

  • SHA1

    b434c582eb759062ba367a4d2a82b8096e28e368

  • SHA256

    1d6c2dfe5d9b0faa88ec4b74ccb7197d41615be0ecddd217b5f242de57016c97

  • SHA512

    d9300084c0d0705bd388e364fe20110de29b4c67f4aae5d8889970f9b0635924ea1ce77e4f97d8e24bb52539af97869dca31bee1c33b710ef2e71e02aa5f7dae

  • SSDEEP

    12288:1a0BE0qgMkaZxgCmZZsKGsb6mXPPZauuwK5BSa5uk:1jE2naZFmZXG0FPZalwK6aR

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1d6c2dfe5d9b0faa88ec4b74ccb7197d41615be0ecddd217b5f242de57016c97

    • Size

      606KB

    • MD5

      516f8626b01eab2884836377e0174b8c

    • SHA1

      b434c582eb759062ba367a4d2a82b8096e28e368

    • SHA256

      1d6c2dfe5d9b0faa88ec4b74ccb7197d41615be0ecddd217b5f242de57016c97

    • SHA512

      d9300084c0d0705bd388e364fe20110de29b4c67f4aae5d8889970f9b0635924ea1ce77e4f97d8e24bb52539af97869dca31bee1c33b710ef2e71e02aa5f7dae

    • SSDEEP

      12288:1a0BE0qgMkaZxgCmZZsKGsb6mXPPZauuwK5BSa5uk:1jE2naZFmZXG0FPZalwK6aR

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasion

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks