ramnit | 1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c | Triage

Submit
Reports

Overview

overview

Static

static

3

1de126e0a3...2c.dll

windows7-x64

1de126e0a3...2c.dll

windows10-2004-x64

Sharing

General

Target

1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c
Size

176KB
Sample

240424-yakysagb45
MD5

bdc5b60b2270edbe9ec773c4df7afd94
SHA1

00040bc518734896aa0ebe1af59c8246f9ebc0f0
SHA256

1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c
SHA512

95a1aed22b2820330538571b30f2b836d0988c57f401dbd242a4bcd0d3a99c69527708bade8b62b1fc579eb0aa589e89df353c4718e34140ea16107f220fe8b2
SSDEEP

3072:IzMciVmlwiWKZy7G0hKGIIfW3SCVV6ciStnxK0cRGY:SM7mygZrEvLySC/KSBxK08j

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c.dll

Resource

win7-20240220-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c.dll

Resource

win10v2004-20240226-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c
- Size
  
  176KB
- MD5
  
  bdc5b60b2270edbe9ec773c4df7afd94
- SHA1
  
  00040bc518734896aa0ebe1af59c8246f9ebc0f0
- SHA256
  
  1de126e0a303b402368ddab90dfccda7815ad7da94b1f77d083cf2457f41692c
- SHA512
  
  95a1aed22b2820330538571b30f2b836d0988c57f401dbd242a4bcd0d3a99c69527708bade8b62b1fc579eb0aa589e89df353c4718e34140ea16107f220fe8b2
- SSDEEP
  
  3072:IzMciVmlwiWKZy7G0hKGIIfW3SCVV6ciStnxK0cRGY:SM7mygZrEvLySC/KSBxK08j
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UPX dump on OEP (original entry point)
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy