Overview

overview

10

Static

static

3

0941125c7a...18.dll

windows7-x64

10

0941125c7a...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0941125c7a50d8e99534b98cf386ed3f_JaffaCakes118

  • Size

    166KB

  • Sample

    240624-slw8assbrr

  • MD5

    0941125c7a50d8e99534b98cf386ed3f

  • SHA1

    97f895820bea60b4de8fb86e5f365ec90cace7ff

  • SHA256

    f6ee60a900a8722afb00a898908f545fe46d0fdc4d5611fa76cf4e1757b3f22a

  • SHA512

    5e4558ebb8dc55893e568f31041e1f835e50a4e589e0bc5261a2cc67035def3980137ef403a26a9a2aaeefd094c6e5841b8db1822780ab6b8b79e29daeeaf2f0

  • SSDEEP

    3072:kTU56gVxj27Nel6fewiVWFZWm7TR1uNZT:34jfGWyK8N

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      0941125c7a50d8e99534b98cf386ed3f_JaffaCakes118

    • Size

      166KB

    • MD5

      0941125c7a50d8e99534b98cf386ed3f

    • SHA1

      97f895820bea60b4de8fb86e5f365ec90cace7ff

    • SHA256

      f6ee60a900a8722afb00a898908f545fe46d0fdc4d5611fa76cf4e1757b3f22a

    • SHA512

      5e4558ebb8dc55893e568f31041e1f835e50a4e589e0bc5261a2cc67035def3980137ef403a26a9a2aaeefd094c6e5841b8db1822780ab6b8b79e29daeeaf2f0

    • SSDEEP

      3072:kTU56gVxj27Nel6fewiVWFZWm7TR1uNZT:34jfGWyK8N

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks