ramnit | 57eeabb25d1f3633f6c1060a2b22e84b6f672d16dcf8e4162d6ebe690c76496e | Triage™

Login
Reports

Overview

overview

Static

static

3

116ade184d...18.exe

windows7-x64

116ade184d...18.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
116ade184d02c4c16150ee360a4a2018_JaffaCakes118
Size 168KB
Sample240626-kr2e7sweqa
SHA256 57eeabb25d1f3633f6c1060a2b22e84b6f672d16dcf8e4162d6ebe690c76496e
MD5 116ade184d02c4c16150ee360a4a2018
SHA1 2d64dd598469a4860117b126ae73ee611b1c6534
SHA512 31f95419ed27c28a17ac82379323b286678d8c1e529a75022826c8602d0ae4f4e45e0ad102a8dd6eb96da1527d0d6388d58d99d83171e79cc3dc1697752888ce
SSDEEP 3072:YkVD1BSqao9c3HwsanTdgyOxsP+f+pl7n5+WoZM73xmqcdSEA:NSqjc3HsTaxoq6n5+Wo5PA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

116ade184d02c4c16150ee360a4a2018_JaffaCakes118.exe

Resource

win7-20240611-en

windows7-x64

17 signatures

150 seconds

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

Behavioral task

behavioral2

Sample

116ade184d02c4c16150ee360a4a2018_JaffaCakes118.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

17 signatures

150 seconds

ramnit sality backdoor banker evasion spyware stealer trojan upx worm

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
http://klkjwre77638dfqwieuoi888.info/

Targets

- Target
  116ade184d02c4c16150ee360a4a2018_JaffaCakes118
- Size 168KB
- SHA256 57eeabb25d1f3633f6c1060a2b22e84b6f672d16dcf8e4162d6ebe690c76496e
- MD5 116ade184d02c4c16150ee360a4a2018
- SHA1 2d64dd598469a4860117b126ae73ee611b1c6534
- SHA512 31f95419ed27c28a17ac82379323b286678d8c1e529a75022826c8602d0ae4f4e45e0ad102a8dd6eb96da1527d0d6388d58d99d83171e79cc3dc1697752888ce
- SSDEEP 3072:YkVD1BSqao9c3HwsanTdgyOxsP+f+pl7n5+WoZM73xmqcdSEA:NSqjc3HsTaxoq6n5+Wo5PA
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ramnit sality backdoor banker evasion spyware stealer trojan upx worm
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

behavioral2

ramnitsalitybackdoorbankerevasionspywarestealertrojanupxworm

© 2018-2026

Terms | Privacy