Overview

overview

10

Static

static

8

b203dfabbb...fb.exe

windows7-x64

10

b203dfabbb...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

  • Size

    120KB

  • Sample

    230129-l5bx5sca6z

  • MD5

    00a9e76cd50f13a7824ea09947434c2d

  • SHA1

    8e2a5aa7ddbd96c4347be109dd4191aa8f1f703c

  • SHA256

    b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

  • SHA512

    7f0ec8268bd7bbf76e9c002d32dae82db0da1239180680ee1ab43871f2414f443a1c8843aec0b8e9c289a3b4414674843b774f195b45d60a4ebbca91e8e1f9b9

  • SSDEEP

    3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnm:h+3fRb9NdndPZMTs

Score
10/10
ramnitbankerevasionpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

    • Size

      120KB

    • MD5

      00a9e76cd50f13a7824ea09947434c2d

    • SHA1

      8e2a5aa7ddbd96c4347be109dd4191aa8f1f703c

    • SHA256

      b203dfabbbd4297522ae9e4c2fee4dfa24a186411afe2d5d9de1ce2f03943bfb

    • SHA512

      7f0ec8268bd7bbf76e9c002d32dae82db0da1239180680ee1ab43871f2414f443a1c8843aec0b8e9c289a3b4414674843b774f195b45d60a4ebbca91e8e1f9b9

    • SSDEEP

      3072:Ig+3fh/PHrgNUqOBx4J2vNbGfvGnd3gW5ZM4/uBnm:h+3fRb9NdndPZMTs

    Score
    10/10
    ramnitbankerevasionpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UAC bypass

      evasiontrojan

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                  Privilege Escalation

                  Tasks