ramnit | a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.exe
Size 68KB
Sample240603-pchf1aea2x
SHA256 1c8d6b8afee606a8f74d8dbc2b6f1840bd1864c10a56a0da888d920921f9d818
MD5 a2fe2b3ac25ab9ab9e7f963ea13569c0
SHA1 5f51f77ca0ec0d724bfbf5dc6686f84b21d42e56
SHA512 0e2e5e3aaa50f46f516a1a88dd8f6a7be2d73cd2c545d811573602c366be7c15fbd95fc9a526459e97963609d08d722e7bcb811cafefe83f734aee3059593be9
SSDEEP 1536:MLNd/Pk7btaoX7DypKr0wN6YIUSS9edBdu0iZs32:GNhY5aora80m6YI7duXs3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit

Malware Config

Signatures

Ramnit family
ramnit

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.exe

File Explorer

a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.exe

.dll .vbs 68KB

a2fe2b3ac25ab9ab9e7f963ea13569c0_NeikiAnalytics.exe

IMPHASH 62a7616cac5efe94334afe90464544ad
SHA256 1c8d6b8afee606a8f74d8dbc2b6f1840bd1864c10a56a0da888d920921f9d818
MD5 a2fe2b3ac25ab9ab9e7f963ea13569c0
SHA1 5f51f77ca0ec0d724bfbf5dc6686f84b21d42e56
SHA512 0e2e5e3aaa50f46f516a1a88dd8f6a7be2d73cd2c545d811573602c366be7c15fbd95fc9a526459e97963609d08d722e7bcb811cafefe83f734aee3059593be9
SSDEEP 1536:MLNd/Pk7btaoX7DypKr0wN6YIUSS9edBdu0iZs32:GNhY5aora80m6YI7duXs3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86 polyglot

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcessId GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileSize GetFileTime GetLastError GetLocalTime GetLocaleInfoA GetLogicalDriveStringsA GetLogicalDrives GetModuleFileNameA GetModuleHandleA GetProcAddress GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameA GetTempPathA GetTickCount GetVersionExA GetVolumeInformationA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalReAlloc HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc GetCurrentProcess LeaveCriticalSection LoadLibraryA MapViewOfFile MoveFileA MultiByteToWideChar OpenFileMappingA OpenMutexA ReadFile ReleaseMutex RemoveDirectoryA ResumeThread RtlMoveMemory SetEndOfFile SetErrorMode SetFileAttributesA SetFilePointer SetFileTime SetThreadPriority Sleep TryEnterCriticalSection UnmapViewOfFile WideCharToMultiByte WriteFile lstrcatA lstrcmpA lstrcmpiA lstrcpyA lstrcpynA lstrlenA lstrlenW FindNextFileA FindFirstFileA FindClose FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA ExitProcess EnterCriticalSection DeleteCriticalSection DeleteFileA CreateThread CreateProcessA CreateMutexA CreateFileMappingA CreateFileA CreateDirectoryA CopyFileA CompareStringA InitializeCriticalSection CloseHandle

ws2_32

recv listen ioctlsocket inet_addr select getsockname send socket getpeername gethostbyname connect closesocket bind accept __WSAFDIsSet WSAStartup WSAGetLastError WSACleanup htons

user32

GetDC ExitWindowsEx CharUpperBuffW MessageBoxA GetDesktopWindow wsprintfA

advapi32

AdjustTokenPrivileges OpenProcessToken RegCloseKey RegDeleteKeyA RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA LookupPrivilegeValueA

shell32

ShellExecuteA

gdi32

CreateCompatibleDC DeleteDC DeleteObject GdiFlush GetDeviceCaps SelectObject SetStretchBltMode StretchBlt CreateDIBSection

ole32

CreateStreamOnHGlobal