Overview

overview

10

Static

static

3

21823c95a9...18.exe

windows7-x64

10

21823c95a9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21823c95a9aa7891f68a1caf8110018b_JaffaCakes118

  • Size

    120KB

  • Sample

    240703-h434fswflr

  • MD5

    21823c95a9aa7891f68a1caf8110018b

  • SHA1

    e3a97f3b001172533e3ff32d1624fe55313eded6

  • SHA256

    7bf3db9bc3354a9b9c655ff3bb33aa96aec2f5c80c0d555c9bc9fc1c1e74a992

  • SHA512

    078a2a21f488f2ceac6feeeb53cd1bfbdf85f86b0e443ac21ccd6303331770fdc6834e74a79ad42c33c9342e399843b347bf8ba4a22db680b513f6c908bfdec7

  • SSDEEP

    768:IQxkwi7BsIqHpcrkMEYEhA7P4RhAtmaZFb79U9MKAjBEig6/1k21m3uHRdMNDj2f:I8kwixTEhU4HDa1KkjWXUa21mc/Mue9I

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      21823c95a9aa7891f68a1caf8110018b_JaffaCakes118

    • Size

      120KB

    • MD5

      21823c95a9aa7891f68a1caf8110018b

    • SHA1

      e3a97f3b001172533e3ff32d1624fe55313eded6

    • SHA256

      7bf3db9bc3354a9b9c655ff3bb33aa96aec2f5c80c0d555c9bc9fc1c1e74a992

    • SHA512

      078a2a21f488f2ceac6feeeb53cd1bfbdf85f86b0e443ac21ccd6303331770fdc6834e74a79ad42c33c9342e399843b347bf8ba4a22db680b513f6c908bfdec7

    • SSDEEP

      768:IQxkwi7BsIqHpcrkMEYEhA7P4RhAtmaZFb79U9MKAjBEig6/1k21m3uHRdMNDj2f:I8kwixTEhU4HDa1KkjWXUa21mc/Mue9I

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks