Overview

overview

10

Static

static

8

f15c00e4d9...20.exe

windows7-x64

10

f15c00e4d9...20.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f15c00e4d90df78c855c09e684d4a7b38fdf8c6562517c5ae4066fb6126c4020

  • Size

    357KB

  • Sample

    230130-d9hbqahc71

  • MD5

    c80dce1c7f49342bc4e3e7faec27574b

  • SHA1

    591cd2f5ee09f24173725d95abb045b97545b043

  • SHA256

    f15c00e4d90df78c855c09e684d4a7b38fdf8c6562517c5ae4066fb6126c4020

  • SHA512

    1cedc6b1aed227f9a686a077b2fa0cd97f7a35e2fe3c5e90be4a3c061e03aad1587da2c47e93ae89f3bce954db3e87b8e2524bbf8c25e45fcfecdf2ad8a49120

  • SSDEEP

    1536:Ih+CizEh+bTIKE5plPxM3/SaxAFZ/Zqrl+McbHu7qAMO9Bv+Pp9Zn0amGwSh:vCTb5pjMvVC/orl+9TuG7a2LZ0axwS

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      f15c00e4d90df78c855c09e684d4a7b38fdf8c6562517c5ae4066fb6126c4020

    • Size

      357KB

    • MD5

      c80dce1c7f49342bc4e3e7faec27574b

    • SHA1

      591cd2f5ee09f24173725d95abb045b97545b043

    • SHA256

      f15c00e4d90df78c855c09e684d4a7b38fdf8c6562517c5ae4066fb6126c4020

    • SHA512

      1cedc6b1aed227f9a686a077b2fa0cd97f7a35e2fe3c5e90be4a3c061e03aad1587da2c47e93ae89f3bce954db3e87b8e2524bbf8c25e45fcfecdf2ad8a49120

    • SSDEEP

      1536:Ih+CizEh+bTIKE5plPxM3/SaxAFZ/Zqrl+McbHu7qAMO9Bv+Pp9Zn0amGwSh:vCTb5pjMvVC/orl+9TuG7a2LZ0axwS

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks