ramnit | 9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c | Triage

Submit
Reports

Overview

overview

Static

static

3

9d3c88c97a...4c.dll

windows7-x64

9d3c88c97a...4c.dll

windows10-2004-x64

7

Sharing

General

Target

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
Size

6.4MB
Sample

231203-txzy1adb5x
MD5

8adb83307ae6216a76e6287e0fc3ce41
SHA1

f0f8340c3ad4a8d2b5c1b9ac18cdee135f96402f
SHA256

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
SHA512

85f5e4e3c3b092fba0e395303ffe2d9b55544e2e817f681b0024dac2fbae71f788f68714d78fab29ca83d0c617fd17b3eec5ebcd74fe7576f35e668e2fde1278
SSDEEP

98304:l0bENqXyMP0OSU/DktQJ54niDXQNUw40DlSDB7lZz3mZg+9d7Kvos2UvMcXyI:l04DIrRFbQmD0DlSdlZ3mZgyxxsQ0

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll

Resource

win7-20231201-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c.dll

Resource

win10v2004-20231130-en

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
- Size
  
  6.4MB
- MD5
  
  8adb83307ae6216a76e6287e0fc3ce41
- SHA1
  
  f0f8340c3ad4a8d2b5c1b9ac18cdee135f96402f
- SHA256
  
  9d3c88c97a95fe20017315c0f916fb001ac3def8d539ae5eb1f094628715d24c
- SHA512
  
  85f5e4e3c3b092fba0e395303ffe2d9b55544e2e817f681b0024dac2fbae71f788f68714d78fab29ca83d0c617fd17b3eec5ebcd74fe7576f35e668e2fde1278
- SSDEEP
  
  98304:l0bENqXyMP0OSU/DktQJ54niDXQNUw40DlSDB7lZz3mZg+9d7Kvos2UvMcXyI:l04DIrRFbQmD0DlSdlZ3mZgyxxsQ0
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

© 2018-2024

Terms | Privacy