Overview

overview

10

Static

static

7

Windows优...EL.dll

windows7-x64

10

Windows优...EL.dll

windows10-2004-x64

10

Windows优...ay.exe

windows7-x64

6

Windows优...ay.exe

windows10-2004-x64

6

Windows优...mb.dll

windows7-x64

10

Windows优...mb.dll

windows10-2004-x64

10

Windows优...ll.exe

windows7-x64

1

Windows优...ll.exe

windows10-2004-x64

1

Windows优...��.url

windows7-x64

1

Windows优...��.url

windows10-2004-x64

1

Windows优...��.url

windows7-x64

1

Windows优...��.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    aa26ec34162e38147b948b39b362d476_JaffaCakes118
  • Size 4.6MB
  • Sample240614-rpcgmathka
  • SHA256 df77dd69b8085bcd0bac0a6493b405b2cb4faab5a8394e9c25dcb594c8735c54
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target
      Windows优化卫士 6.0/YiXinSafe/SkinH_EL.dll
    • Size 143KB
    • SHA256 931eb554bad234bbd3b427237ece1ab509a9b6da5fb1bcd8d668f08d52201771
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      Windows优化卫士 6.0/YiXinSafe/YiXinPCTray.exe
    • Size 1.3MB
    • SHA256 3ba42211ae2fdf56182fef332f11c9d1b9ed5ed5fd57838b604418aa8cfc322e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    persistence
    behavioral3behavioral4
    • Target
      Windows优化卫士 6.0/YiXinSafe/mb.dll
    • Size 8.2MB
    • SHA256 1f48007c2b9c6fe919579c3375d2505727f5fcf1b5059cb769cb81bfc9be4ce4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral5behavioral6
    • Target
      Windows优化卫士 6.0/nsUninstall.exe
    • Size 381KB
    • SHA256 c67bf1732374270d710c73b7e613832d67b2d933839a9d7eb4bf2de88b0919ab
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      Windows优化卫士 6.0/华彩联盟论坛.url
    • Size 195B
    • SHA256 4ce090788a79b4ee816322f0fa57e7020f1108911fc6cdf1ec7b437cd2187782
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral10behavioral9
    • Target
      Windows优化卫士 6.0/华彩软件站-使用必读.url
    • Size 195B
    • SHA256 ee0e7e1a20dd376bd088291e97394ad8c2b43f6638e69179a288e8d2c986d9df
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral11behavioral12

MITRE ATT&CK Enterprise v15

Tasks