ramnit

General

Target
204737a14ffd80e2aea582a2322458d8_JaffaCakes118
Size 416KB
Sample240702-wfbk7avaje
SHA256 368941dcf234eca1151b04def2bbbf08419d472d2d0ed1fd6b1c4c4c01614809
MD5 204737a14ffd80e2aea582a2322458d8
SHA1 84fdbe2b1dda7d0aa28231da05551082b9bf449e
SHA512 1c010c1766842addde212d8e6e41436bf52cc755135e57e0695e7a036b3a16b9489b2489820b1212fb0c2c78cc9b89d4bb6699c7121b415efcfcc76f31ae9d15
SSDEEP 3072:Ru9izfYc/xH+/z3GhxDShxT2fS9+Zyi2eSHPFBgKLjBB9W541RXhxGvckxLHQbIG:g9g0kxLHQbP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  204737a14ffd80e2aea582a2322458d8_JaffaCakes118
- Size 416KB
- SHA256 368941dcf234eca1151b04def2bbbf08419d472d2d0ed1fd6b1c4c4c01614809
- MD5 204737a14ffd80e2aea582a2322458d8
- SHA1 84fdbe2b1dda7d0aa28231da05551082b9bf449e
- SHA512 1c010c1766842addde212d8e6e41436bf52cc755135e57e0695e7a036b3a16b9489b2489820b1212fb0c2c78cc9b89d4bb6699c7121b415efcfcc76f31ae9d15
- SSDEEP 3072:Ru9izfYc/xH+/z3GhxDShxT2fS9+Zyi2eSHPFBgKLjBB9W541RXhxGvckxLHQbIG:g9g0kxLHQbP
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

ramnit xtremerat banker persistence rat spyware stealer trojan upx worm
- Detect XtremeRAT payload
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- XtremeRAT
  The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
  persistence spyware rat xtremerat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2