ramnit | deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b | Triage

Submit
Reports

Overview

overview

Static

static

deb5deb65b...6b.exe

windows7-x64

deb5deb65b...6b.exe

windows10-2004-x64

Sharing

General

Target

deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
Size

160KB
Sample

230130-d9kf3sfh68
MD5

9a6a913cceb071140108ff9df1d1ff5b
SHA1

116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256

deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA512

55c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
SSDEEP

3072:aT2xNfzEmPUac0yCRS9EK0TLmV/MsdpFJma538ZNvWPJFlD:OkPpe0mB3N8zWDN

Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe

Resource

win7-20221111-en

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe

Resource

win10v2004-20221111-en

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

windows10-2004-x64

20 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
- Size
  
  160KB
- MD5
  
  9a6a913cceb071140108ff9df1d1ff5b
- SHA1
  
  116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
- SHA256
  
  deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
- SHA512
  
  55c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
- SSDEEP
  
  3072:aT2xNfzEmPUac0yCRS9EK0TLmV/MsdpFJma538ZNvWPJFlD:OkPpe0mB3N8zWDN
Score

10^/10

ramnit sality backdoor banker evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Modify Existing Service

Privilege Escalation

Bypass User Account Control

Defense Evasion

Modify Registry

Bypass User Account Control

Disabling Security Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerevasionpersistencespywarestealertrojanupxworm

behavioral2

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy