Overview

overview

10

Static

static

3

fd8b7cc746...18.exe

windows7-x64

10

fd8b7cc746...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fd8b7cc746fc27918453cfc3130ad695_JaffaCakes118

  • Size

    123KB

  • Sample

    240420-yx8y5ahc9t

  • MD5

    fd8b7cc746fc27918453cfc3130ad695

  • SHA1

    1ae1e84d35751fd4fda9061cc76e5858a4507fc0

  • SHA256

    400cc13a93476835b45f5452b534f0d2e217b2818ac561d16c50619ba169da0a

  • SHA512

    c279ca56e38d7f2558179357259a220619acc030ad6e9eaeaa7d2ac34f19068cdc036fa14efd4b3e9a42886513efe6a0f9881d8bd95dc988d5ba1f284d4b3be2

  • SSDEEP

    768:F06R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:zR0Zn3Pc0LCH9MtbvabUDzJYWu3B

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      fd8b7cc746fc27918453cfc3130ad695_JaffaCakes118

    • Size

      123KB

    • MD5

      fd8b7cc746fc27918453cfc3130ad695

    • SHA1

      1ae1e84d35751fd4fda9061cc76e5858a4507fc0

    • SHA256

      400cc13a93476835b45f5452b534f0d2e217b2818ac561d16c50619ba169da0a

    • SHA512

      c279ca56e38d7f2558179357259a220619acc030ad6e9eaeaa7d2ac34f19068cdc036fa14efd4b3e9a42886513efe6a0f9881d8bd95dc988d5ba1f284d4b3be2

    • SSDEEP

      768:F06R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:zR0Zn3Pc0LCH9MtbvabUDzJYWu3B

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks