Overview

overview

10

Static

static

3

672cafdb04...93.dll

windows7-x64

10

672cafdb04...93.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    672cafdb040972a1e0827958b3afabce1576f8e0cd59f669b04863a258bb4c93

  • Size

    832KB

  • Sample

    240529-2gnj2adc28

  • MD5

    fee29d749e9a6755526a0c517164cb16

  • SHA1

    4232c812300820be5f637b15c68959961f316a33

  • SHA256

    672cafdb040972a1e0827958b3afabce1576f8e0cd59f669b04863a258bb4c93

  • SHA512

    81994cddf01f31c7b3c2ff5b73f21da66b2496a313d5774bd73919b03f410f31bf1722136e09088d8b6174eca019f6d9fd0c42e767dd9b1274e05a530b7191ac

  • SSDEEP

    24576:TxTyK5ZRYoRwVZlCvQ3cRB7aBq3U9T3Gaw:TxRp/RwblCvQ3g7c39jw

Score
10/10
ramnitbankerevasionspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      672cafdb040972a1e0827958b3afabce1576f8e0cd59f669b04863a258bb4c93

    • Size

      832KB

    • MD5

      fee29d749e9a6755526a0c517164cb16

    • SHA1

      4232c812300820be5f637b15c68959961f316a33

    • SHA256

      672cafdb040972a1e0827958b3afabce1576f8e0cd59f669b04863a258bb4c93

    • SHA512

      81994cddf01f31c7b3c2ff5b73f21da66b2496a313d5774bd73919b03f410f31bf1722136e09088d8b6174eca019f6d9fd0c42e767dd9b1274e05a530b7191ac

    • SSDEEP

      24576:TxTyK5ZRYoRwVZlCvQ3cRB7aBq3U9T3Gaw:TxRp/RwblCvQ3g7c39jw

    Score
    10/10
    ramnitbankerspywarestealertrojanupxwormevasion

    • Modifies firewall policy service

      evasion

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • UPX dump on OEP (original entry point)

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks