Overview

overview

10

Static

static

6fef318765...14.dll

windows7-x64

8

6fef318765...14.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6fef318765058ec8884f1bc28d1ab42015d94a628367d6d6a93b23b87ca58c14

  • Size

    296KB

  • Sample

    221202-hcqdaabh93

  • MD5

    716c59de007f14c33622a5f448cd72b0

  • SHA1

    24269bbef5b64a6e41295f7872787581a49d4a67

  • SHA256

    6fef318765058ec8884f1bc28d1ab42015d94a628367d6d6a93b23b87ca58c14

  • SHA512

    4ca01aa625d88521de9b96ba8d488e148df4987b579522fd574e7b8b3fd62dc97a7f9fe13be0c495e63d3556161aa3deed5fa7c92b101e7b62b1bc8c5070aaed

  • SSDEEP

    6144:Bl9XgnzxOP/sFR2h+9q1kih6ibUxrp3/vIyRvCsZIFVlUxHes:BlCzcMg+9YkDiQ3/QgzZIvlaHB

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      6fef318765058ec8884f1bc28d1ab42015d94a628367d6d6a93b23b87ca58c14

    • Size

      296KB

    • MD5

      716c59de007f14c33622a5f448cd72b0

    • SHA1

      24269bbef5b64a6e41295f7872787581a49d4a67

    • SHA256

      6fef318765058ec8884f1bc28d1ab42015d94a628367d6d6a93b23b87ca58c14

    • SHA512

      4ca01aa625d88521de9b96ba8d488e148df4987b579522fd574e7b8b3fd62dc97a7f9fe13be0c495e63d3556161aa3deed5fa7c92b101e7b62b1bc8c5070aaed

    • SSDEEP

      6144:Bl9XgnzxOP/sFR2h+9q1kih6ibUxrp3/vIyRvCsZIFVlUxHes:BlCzcMg+9YkDiQ3/QgzZIvlaHB

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks