ramnit | dd7beb2380ab420e4d28a2389276776ab9e40d2c15ed0db77b13effb51b4a8af | Triage

Sharing

General

Target

0618708c326cd1e6ba1bee266157853e_JaffaCakes118
Size

202KB
Sample

240428-z7zzmshh3t
MD5

0618708c326cd1e6ba1bee266157853e
SHA1

fdf22fbd08c50e1f9d82d234b41c9ffef4886642
SHA256

dd7beb2380ab420e4d28a2389276776ab9e40d2c15ed0db77b13effb51b4a8af
SHA512

6677ad6a0b9862fbd7a492d23d450d2d7dca0f6ab7b5f61e7b72a35673c7cb98f6b9f06d2267a41f06791520a0c26bebb5d62d1ec6175f65b666611b91f7de92
SSDEEP

6144:SkzLHQ8C/NN273OX5UB97Y9qgSvmg8qXt:h7Q8M2apdvSBt

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  0618708c326cd1e6ba1bee266157853e_JaffaCakes118
- Size
  
  202KB
- MD5
  
  0618708c326cd1e6ba1bee266157853e
- SHA1
  
  fdf22fbd08c50e1f9d82d234b41c9ffef4886642
- SHA256
  
  dd7beb2380ab420e4d28a2389276776ab9e40d2c15ed0db77b13effb51b4a8af
- SHA512
  
  6677ad6a0b9862fbd7a492d23d450d2d7dca0f6ab7b5f61e7b72a35673c7cb98f6b9f06d2267a41f06791520a0c26bebb5d62d1ec6175f65b666611b91f7de92
- SSDEEP
  
  6144:SkzLHQ8C/NN273OX5UB97Y9qgSvmg8qXt:h7Q8M2apdvSBt
Score

10^/10

ramnit banker spyware stealer trojan upx worm evasion persistence
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops startup file
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerevasionpersistencespywarestealertrojanupxworm