ramnit | aaf3217873dc472a323ea35b46a945635a4b20fc9ccec6eae30cef0ab770e16f | Triage

Sharing

General

Target

xjEbd9k
Size

130KB
Sample

240424-kp75zagb81
MD5

7ebc135f08863359b9089a86149b9737
SHA1

84c87bc0c3354aad42fae4e5b2d2c2fd7c129688
SHA256

aaf3217873dc472a323ea35b46a945635a4b20fc9ccec6eae30cef0ab770e16f
SHA512

ea893856ac6aee3c5225c5fe67d1a9c0e3d4f366289802ba670381973d84831dd208a2bb0e1f54a058d2840b13c9b3c306c63bbfb75cb83665de455a292ab34b
SSDEEP

1536:Z3Hh76d0SmQgo6OW8EneylqAjBzslMlGAuZWLEORE0A63Q6/ASDfBUisoY9bDy5y:FhMgTTeW4lMyWLxR3A6h/Px00Dy

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  xjEbd9k
- Size
  
  130KB
- MD5
  
  7ebc135f08863359b9089a86149b9737
- SHA1
  
  84c87bc0c3354aad42fae4e5b2d2c2fd7c129688
- SHA256
  
  aaf3217873dc472a323ea35b46a945635a4b20fc9ccec6eae30cef0ab770e16f
- SHA512
  
  ea893856ac6aee3c5225c5fe67d1a9c0e3d4f366289802ba670381973d84831dd208a2bb0e1f54a058d2840b13c9b3c306c63bbfb75cb83665de455a292ab34b
- SSDEEP
  
  1536:Z3Hh76d0SmQgo6OW8EneylqAjBzslMlGAuZWLEORE0A63Q6/ASDfBUisoY9bDy5y:FhMgTTeW4lMyWLxR3A6h/Px00Dy
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops startup file
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerevasionpersistencespywarestealertrojanupxworm