Overview

overview

10

Static

static

7

NEAS.a6520...f0.exe

windows7-x64

10

NEAS.a6520...f0.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.a6520be4c2ed2d75cbdac4e2ae91ddf0.exe

  • Size

    77KB

  • Sample

    231102-ty57eagh83

  • MD5

    a6520be4c2ed2d75cbdac4e2ae91ddf0

  • SHA1

    dc4b0db4aaac4933a0c4998da1c5e546e452e961

  • SHA256

    5eb004e06f6eb756710bc4870ad24f39deb4872fa3cacd92201c5c67d58fd8b5

  • SHA512

    49ecb1a519c0677326c799b15e8f810d24e5ac07a1484d6dd91234c391764a3b9897fb056140406146206dc297b3cc8aeb060e6685c0378e256b244d6d585f03

  • SSDEEP

    1536:Mt5qNEeUi/mn1BvvxIj1urfU8m21MnkCuB5Al7bxiR2:s5qevA2FvOjUnm2CnkCuElPIR2

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      NEAS.a6520be4c2ed2d75cbdac4e2ae91ddf0.exe

    • Size

      77KB

    • MD5

      a6520be4c2ed2d75cbdac4e2ae91ddf0

    • SHA1

      dc4b0db4aaac4933a0c4998da1c5e546e452e961

    • SHA256

      5eb004e06f6eb756710bc4870ad24f39deb4872fa3cacd92201c5c67d58fd8b5

    • SHA512

      49ecb1a519c0677326c799b15e8f810d24e5ac07a1484d6dd91234c391764a3b9897fb056140406146206dc297b3cc8aeb060e6685c0378e256b244d6d585f03

    • SSDEEP

      1536:Mt5qNEeUi/mn1BvvxIj1urfU8m21MnkCuB5Al7bxiR2:s5qevA2FvOjUnm2CnkCuElPIR2

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks