Overview

overview

10

Static

static

3

nzhsdsdsdf...RO.exe

windows7-x64

10

nzhsdsdsdf...RO.exe

windows10-2004-x64

10

nzhsdsdsdf...py.dll

windows7-x64

10

nzhsdsdsdf...py.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a98859d971689a430c0a1b80bac601ec_JaffaCakes118

  • Size

    491KB

  • Sample

    240614-n1lmwszbmc

  • MD5

    a98859d971689a430c0a1b80bac601ec

  • SHA1

    a6eb9ee99bded4a8aa076619d7095cd95b357a10

  • SHA256

    53606c2b601c5ccd9e48acfd2c3d9efe1067a0e332ce164deda39331a89bab4d

  • SHA512

    7b5fab0edf35e2a5950fbe6c5acf256f243bc2243b1d6c60d0f71bd8d66acbb91dd968469fba2f75126c0f92f7bf7b444a8c4384982a068f96b4f77e24ffce7e

  • SSDEEP

    12288:ubsvCvaFuLkVq/inP0SrX6jZZ5+SOZ9PqvVSOZN7b:pqjkVkQP0SrX6n5o9Pid

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      nzhsdsdsdfob_gr/WPE???/WPE PRO.exe

    • Size

      872KB

    • MD5

      8137381d6b04f796084650da3c2c2b2c

    • SHA1

      b99f7ff6803c85c49220ffcc90115c8a92d41d23

    • SHA256

      42124a85efaf4d5f5ff84960ac3fb9e04a3c257564dbcd6bff51394907d05c76

    • SHA512

      2af5839fec534f28e7540cd01b5d9ccc670a8810354782b8ddbed0410cd1fe03ef6c4ce47d37c0518e584e2fd20891686e30d0fb100cb205fbb0540c24e0cf5a

    • SSDEEP

      12288:x3v6sgx8iIivBmxWb30XJe4s1lPSOCx8zmRaar5kuHer2zHhaJsIetKcSOZ:x/6tIu3Ujs1VDCx3GuD5V

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

    • Target

      nzhsdsdsdfob_gr/WPE???/WpeSpy.dll

    • Size

      240KB

    • MD5

      c0b3d9224581e295d8f5ce0ae86982d4

    • SHA1

      0d404e938ab17797b4008baebca798b29f94eb47

    • SHA256

      39e9ed70d98e831985709f97179fd15df53ffd742413b703666ac42883ebb528

    • SHA512

      6d41f87c02018d30eb9195c6b9897a203bcf12e948037b88aab93d0d79ef4ce2ad3dbe299863ad4d1e0228802755ff620768d5db970077f11ec73ffb85c2527a

    • SSDEEP

      3072:VTwVxBeB2km7lo4jSup5aQ4ctM5sKuI2r:VSBvkmHjSunVM5RuJ

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral3behavioral4

MITRE ATT&CK Matrix ATT&CK v13

Tasks