ramnit | ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
504116fe560f21188b73ac17b6388f38
Size 12.3MB
Sample240110-lxswpaebc5
SHA256 ca493000c5eaff8432d6e2f3fc11a35fc019f1ff30806c661fba26e9941b5fb7
MD5 504116fe560f21188b73ac17b6388f38
SHA1 0d7e3c6961e4d5e39f689641eb3c981bc5e0958d
SHA512 9a1db4b2f610c3c4c75ac0ced7c273b6cd199df68e57b8a94f7faace0239f1e353ec2549313789f94a4f1f550082f90dca2b782f1c9ebb26daadb18373aedef1
SSDEEP 196608:Kda1SgE1FyNhBQBsNANhiDajuvtdQlLCN3R2pP0iQ/p/Oh:UalBQyNAG2SbN34syh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit banker spyware stealer trojan upx vmprotect worm

Malware Config

Targets

- Target
  GongShaFuZhu13/【x1】攻沙辅助/cfgdll.dll
- Size 59KB
- SHA256 767b2e735693a9455a23b19e7a94643fd6095fa1158cbe22f612d657ebbb670d
- MD5 929f56b46242fa68a616374a5403689b
- SHA1 45b4ade1f0cc2bf13e74d9801eee5c7abee3c3b2
- SHA512 81c69649efff9d320533bcb3256d42c671877e1d48f9df99134c514aa2d888d11ded13b9d3447949881513e376cf4644b41b997cad2a9ffb51f4f45ca3cdc641
- SSDEEP 768:eaEHTGEBv6OuJjxqbhJKOBGxoVlbP2nP8oMRIEw8q:eHHTG7OuJjsKOBlVh+EoMjw8q
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/FILE.DLL
- Size 40KB
- SHA256 c9515d3d0e549e978fdd8ae762bd7b73f1ec1dd49c058ad9cd4537902db87670
- MD5 1b12290100f56cf13ac7bd631adebe7d
- SHA1 d996c99e4ccb91876e9da397ec547aebb83c0c94
- SHA512 cd0e417f7ef5d1749f78bded6ac77bcc15aa72268bbb2ec8322f964a11d70f0ecfaaa4ecc10d13a2df743329982bd88fdb8f7f785a50dad33d112e27e372b815
- SSDEEP 384:Ik5Y5bNAguM1vVOiignzJjaJ5htgk0jDrmq5pp/xI3eYP5zo9Y:I4Y5pZVLiQJmltgrjDrmq5/K3ce
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/MSG.DLL
- Size 40KB
- SHA256 417172e573177c921715ade25a63909ca986e11e16c3858ec0ef327c3d65355b
- MD5 3f92f9c3ac33dcf97741eb937c3e7c44
- SHA1 8c950edebb7749dc5939fd2841a1a81d2809ed68
- SHA512 5c32833e48dd6e4f8b0073d7d23e0342e00d94e460bfd83d51087dafbf0706f7e255c1458155690b223310cb4b0a6bd3afbccdedc9ea13ecacc6ff6e28eb6a23
- SSDEEP 384:GEkt05A3HUNImsuw0h/g2WMbMFGc6DJz9u9IFy9ILiTnuozMh+rRL+GhD8sQI7Nm:rA30NIfobNn9uBDT5RrB+GhD8yK1
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/READ.DLL
- Size 1.1MB
- SHA256 1b0d6b44500e8fd35eed25b6951689e32b69dfc722459dcad71c252d2117dfae
- MD5 daa9fd7d53682402007b0c23d53d8388
- SHA1 4e2fe5e848d1c45896d5c7ed9b910c511c60c5d2
- SHA512 57bf5971b2ad33aa3d8b62184bd43e09bf40d0c798e7455438d36e947f55c4cfd1108555994b84d57dbff7d88c853d5541c9e25ca6ee25f0d755cbab1ea396f3
- SSDEEP 24576:Am3S712XoymTONjtHmT6klfan//UbU9Gz:H1jtM+/Ubhz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7 behavioral8
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/REGDLL.DLL
- Size 24KB
- SHA256 3453bb9b4550dd5a51a64c3d2d25f1b49744b05ac740c57f2dd9f89084811318
- MD5 e29d9a912204844df5306ca3935b1f1c
- SHA1 19ba6440827ad2ac515aeb6c8700fbb4c896e61c
- SHA512 9229d5c845eeb36cd293e8d998aca63ed14f41b43d7d11da8682ede4d24853eff19bf0801b8ab055d50c849be7cbf94b890a672d90b55eec5019cebf98925a3a
- SSDEEP 96:Q+fvNT4ui9YFfZVS7pxN3LusGOKmzXyUo2SZjvnEkWRA5mJL4DwdQTDut9Zdn0K/:TcYbM1H3ysce2NEkWCG4DoQTD0d0+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10 behavioral9
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/REMOTEANSWER_JDYOU.DLL
- Size 2.2MB
- SHA256 16a87d4e3d2683788e0b54672e81c50f3b9257709857681db7f85de35ea9ef32
- MD5 53a11435be30e6df4850675a590a6e00
- SHA1 82fced3c9187faed9727c633ed9d9dd37653f88d
- SHA512 d5861e7473fa429563578ccee3451d4eecdce5590d697301f2ec2ccea9dab859c28896945535ef21b28c3a96a03982914a64c9db7ac6a88084f0fddb7b99beac
- SSDEEP 49152:6Xx8e+xXb35bYAJTJWv7IQgbrq5NyYisABrUaL:6h8db3RYqwvgEIv0
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

vmprotect
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral11 behavioral12
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/SGUOBROWSER.DLL
- Size 48KB
- SHA256 7170daad1770562192dfc6cce34f09f1804a9c5852ba8a7acb5127d70acd34a9
- MD5 8dc95c9231e8448c34b350486e3e1133
- SHA1 c828eaaf32e053bd7f6046b5708c1fe9ebb09e37
- SHA512 e4bf1925b9bc8cbd2df7dab311041fb831213d12edbad16808923b6bef3ef9ec192fe5313bfa4da3e75b106dbc86657fdf34714fb8e9d5ad4b88b1dcf5a94e46
- SSDEEP 768:0G6I2742gM31Q0v+BDnHOjsIKeKsjnoyp7P:D644lmDHODhKIno07
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/WEBOPERATION.DLL
- Size 168KB
- SHA256 7e81661a5d6524cda1c736dc27ff5aeba1bacbbcf66fb5f806e26ca54e19bfec
- MD5 0eb164739231276b6b90a7171bded144
- SHA1 fc822838bd8d0d0a5c133f144544ecaecdb2d7f3
- SHA512 6850b9d097a92542a08e239efd2c950e068aba79fabfea43907358aab76e2878b1ec363c711272c49f73c9d0ad79c54daa2330d8872f8332196ddec1dde016dd
- SSDEEP 3072:rs6fcX1fIUmUq7/kMU9aXU/se9CMMU5kslOHBSbdhBqnPl9tIABFIFAF:YOJ5XIT/sXtIAwk
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  GongShaFuZhu13/【x1】攻沙辅助/plugin/WINDOW.DLL
- Size 44KB
- SHA256 9707781fc0d1d932e527612cff1dd5cb5a555e3ee247a91338aa58885b7bd92d
- MD5 215fce089f76039fe9846dbf18d0301d
- SHA1 c64e520094461914117261f94907e486d1cc9d9f
- SHA512 eec412f9dd95d01c3d5d5d884cb8e9c1a7d52501ad9368a5e266e833f51db39d8a2e844d97f088a7aaf76ffe853985cef6e6d6cc874cd7895c75a7dbef02e8bd
- SSDEEP 768:8MiTToZEA9PVIv69VXVqrGny6AcDlDSC6:8MeTgEA9Nk69VXAGny6A+Sh
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  GongShaFuZhu13/【x1】攻沙辅助/xgs/RegDll.dll
- Size 84KB
- SHA256 7f5183494801b0b4314fe387589b7d5d41e03025dff3dde70f7c7e09723ef5c1
- MD5 a2d61eff3148f2c70404927c0146306e
- SHA1 cd9f8247d726a9b437a49a5824dbad9b1a6928a7
- SHA512 d2eff12a8baa1911ec2f28c43243afb7fcbbe3e6cdeb799364db95089fd370dc8f30b49c7ea3eb81ae4b846e29860428a84c96497ecdb1f5f928200605fc5e00
- SSDEEP 1536:I2FWCT03n3KYFcZvi5/0LI6LdEavoWZpEkt/Edm50E:lFWCT03n3KyyqmJFbpEOE0C
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral19 behavioral20
- Target
  GongShaFuZhu13/【x1】攻沙辅助/xgs/dm.dll
- Size 906KB
- SHA256 d003f814a6828ee02a26049407d38785262e969faeb00b6bc3179ed4fec061ae
- MD5 faf2c7db70ec0fe4596c0395e5eb228f
- SHA1 bcc89bff37ac8eccd85162c44c0477f412f2c616
- SHA512 1b0ee5731f1726cce2047800e8c8adcc725f92b3c94b0e56e9cc2d33f64e3f9e1a0356558e97b8ed80ca40ba068dc07b70f4df46f6dc62729428d05e8725828a
- SSDEEP 24576:DWQBeP+QrqH2zKBd3G0Ypdrcc2iIZl2mBVU89XQBpizYho1SH:DWZnGIKb20Ar8iIZfBVdXQBpuYw
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral21 behavioral22
- Target
  GongShaFuZhu13/【x1】攻沙辅助/xgs/help.doc
- Size 31KB
- SHA256 d0a325e5f120dd6a733bc043dd3fae2c0c7e5844f1b335d3081e8d1c5d032eee
- MD5 470b257f2ce348e6dbf6efac504f6167
- SHA1 7eb1d611bef0744a04ae7e6723003e9a584d08bf
- SHA512 78cf130d0f6769025dd3264d2b31c944564417af37c783cd682485e7a3e057c8b5a57f04d8072d0c6121edf41609267a3ae8f7acccef1ee362ec9c961945b80b
- SSDEEP 192:J1N77BcWyZQANt9Uo6Squ2xVagUky4j0k/8sad/u:HN7VcWvAb9Uo63Wgny4j0k/8
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10
behavioral23 behavioral24
- Target
  GongShaFuZhu13/【x1】攻沙辅助/攻沙辅助v1.3.exe
- Size 7.1MB
- SHA256 85dd8661b619b7a91f4516c69801007c7576a92feb491b70cb9a043a3b691e4a
- MD5 a73b9eb2e3dc9aa3b24064924b87b43c
- SHA1 6ccefc45328173090cebc5c249c4e1dda1c8cd92
- SHA512 05331048c85fa118e2a5a54e9e009c839ef31413474a8ceafe1636a99e2157eb4b51182d9ee65379a62f8eea98db22806541fd1f5e7e49a8aded21344c7ac388
- SSDEEP 98304:T5lG4JA2toGeAMzBl8TDZCthjG3DO7jd8vtdUCo8G0OmOyndn44CWZXGp/n0iceM:TANhiDajuvtdQlLCN3R2pP0iQT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  GongShaFuZhu13/【x1】攻沙辅助/辅助浏览器-Browser.exe
- Size 112KB
- SHA256 ff4351ade586b170a211fcc58a91795a6e0c526d7e5714076210e32ab26c9132
- MD5 06a7e93d59d85b421341e8f42a73304a
- SHA1 89921c4d91ed76695a36c22aebd58ce43f13ff46
- SHA512 cfdca04b1fe0eb08ebb82f5a4a3d0f52c7704c7feefc7b47691910563038994ec0e8fa7b599c5671861e88e39cc22e4a5e9b4f6c60af7a7ee2e48692b441d2c0
- SSDEEP 1536:5Cz3tcnp0HSOBVbky/z3tcnp0HSOBVbkyz9NKgkfdTlrrKhi+z3tcnp0HSOBVbky:5Cz92+jBjz92+jBsIi+z92+jB
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28
- Target
  GongShaFuZhu13/游迅网.url
- Size 111B
- SHA256 cde0b34adaa12cdc1a54e5d7ecf7a4875ffbafd69d6811c4e3f22344290f5c7a
- MD5 1e73d11eb7965dda7e821b0d261600cf
- SHA1 a781cb6a6eb203f0d19686e40ef1c8361ec22c23
- SHA512 65325d5976db3f65ebf426a9cd4021d250a2bc43f6990996a2f553de08dc28e9a5b617decd9738f174de76c13e0cb047c634abbbd01a2047643c20fc9252429d
- MD5 SHA1 SHA512
Score

1^/10
behavioral29 behavioral30

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

ramnitbankerspywarestealertrojanupxworm

behavioral20

ramnitbankerspywarestealertrojanupxworm

behavioral21

ramnitbankerspywarestealertrojanupxworm

behavioral22

ramnitbankerspywarestealertrojanupxworm

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30