Overview

overview

10

Static

static

8

b52dbb4753...96.exe

windows7-x64

10

b52dbb4753...96.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396

  • Size

    94KB

  • Sample

    230129-lm85xshg62

  • MD5

    0b11de951151ae8ee0888d559c9f9a00

  • SHA1

    f2b1a65a40e358af6050e20e4b701741a8e4a059

  • SHA256

    b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396

  • SHA512

    1b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37

  • SSDEEP

    1536:3o38k0oFIMN5C/5Zm2/h/40MVskmm0B4uP3sJ+b54BEAtWgjp9At:39oqyWT/4Js0kv3q+b5bAtHjA

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396

    • Size

      94KB

    • MD5

      0b11de951151ae8ee0888d559c9f9a00

    • SHA1

      f2b1a65a40e358af6050e20e4b701741a8e4a059

    • SHA256

      b52dbb47538dd79be8e612363931ae451763ce3b12f2c2fb1e2442ce32a2a396

    • SHA512

      1b72fd918b2bbc870ebde5f4feff297a045858941d78e398eae2b2cfc3d3a0e2f36e928acc696b27975003c10342d9a9433ed8e919f47ca65ee83b98fec77a37

    • SSDEEP

      1536:3o38k0oFIMN5C/5Zm2/h/40MVskmm0B4uP3sJ+b54BEAtWgjp9At:39oqyWT/4Js0kv3q+b5bAtHjA

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks