Overview

overview

10

Static

static

7

DNF魔音�...EL.dll

windows7-x64

10

DNF魔音�...EL.dll

windows10-2004-x64

10

DNF魔音�...��.exe

windows7-x64

7

DNF魔音�...��.exe

windows10-2004-x64

7

DNF魔音�...mp.exe

windows7-x64

7

DNF魔音�...mp.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    883a06a28ba06930de6d6623402b8f1d_JaffaCakes118

  • Size

    4.9MB

  • Sample

    240531-y3a92scf79

  • MD5

    883a06a28ba06930de6d6623402b8f1d

  • SHA1

    1b35198eed56aef94df3995ba71e271cf950253a

  • SHA256

    cb5d0cbdb67999195774b664e6c629af593db6d6c3c72cce06ca6ca813b0e330

  • SHA512

    a4350787249d8962ecd81354669d386feffbe585d5e67bb253776e212e3a7a9ade3f3b2cef632e2dc38249723ce7d53951a35ac0786819f90e8587a8975151cb

  • SSDEEP

    98304:iggMjFQjebuccsZrae3Q7e9ymb2mEiW1PTfRuwsoElAYBffxLAo9xZW/KIRGXBFx:iggMv+sAe9JW1PrRuwsJn5fZW0BFx

Score
10/10
ramnitbankerspywarestealertrojanupxvmprotectworm

Malware Config

Targets

    • Target

      DNF魔音辅助/魔音09-01A/SkinH_EL.dll

    • Size

      143KB

    • MD5

      8b809b04d46ca19acece48322e2ca94c

    • SHA1

      1dfd71e1f1297781edc6c489e70c11f8cbb28d62

    • SHA256

      788f88bbc18d2040c6d378cfe1539ad159674b068877216b38171eadb037f6c1

    • SHA512

      a657c9ac811a0054ec8983cfd03de498f75646fdabc4053a8549403bcf8ad2dc3fbc55399a9b259cbe39c65c16e9a855d3d13a5253a5b4a6bcfb204c2ff40c4f

    • SSDEEP

      3072:x5Np2dlUX0+Cx17F8QRJZKmOK3outK8Cw+m/457q8TqIbn9a+:PFwT7SMJMzUoSZ7m7qgHb

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      DNF魔音辅助/魔音09-01A/拖拽破解补丁.exe

    • Size

      1.0MB

    • MD5

      df71d8acdb7eb1afe2595924ea9f3e93

    • SHA1

      91b7a562461d1b49d2e24d893880212c950767b3

    • SHA256

      9076dac8dc515c0baf37bbe4918fa6c9362b57745898496a149ccf2e12f55c63

    • SHA512

      46c5045a5283338f3859c335d4344b7606bf04557125df31a660e46b5ee21df029530c9ea57e660cf68945d2afe334c52db3c9cd5494b0ed0204053386358602

    • SSDEEP

      12288:MVlkUKEL+gbZBizHBB6obgVgCatI+DgFcEqXVGrWR5nWFpPoSYMz5Moo9:MVeEL+gdBKHz6PVgBdy/qFGrNb+MtMn

    Score
    7/10
    upx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral3behavioral4

    • Target

      DNF魔音辅助/魔音09-01A/魔音9.1A.vmp.exe

    • Size

      4.3MB

    • MD5

      4d95548d416e71efa78a741627edd8e4

    • SHA1

      0d0bfa18349e88aade2042ae92323444164b2f2b

    • SHA256

      b4fa8a1eb5fce78bfc89aa0f336156fd959b7c8cce35e63be05d5cf34983f152

    • SHA512

      cb731bbfbecf4b787806fee4beeb3ebc8836e854e8886ea6004a83feb5069bfcd753db819ef0ba87cfdad85908200e553c739bb04af69e55b55799b1e220c58a

    • SSDEEP

      98304:MpUzdq1dVHJzj80vGTAV0QEcdKDu5ifijReEXdnkZJKAi4yfq:GUzdq1PJzjRv7VTEcdkZqj4Id2i4yS

    Score
    7/10
    upxvmprotect

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks