ramnit | f2c40cc7ca758ca1739986c7151989daaeea44d7f65cbe8cc565879b21b5dbc5 | Triage

Submit
Reports

Overview

overview

Static

static

3

30d7c84e79...18.exe

windows7-x64

30d7c84e79...18.exe

windows10-2004-x64

Sharing

General

Target

30d7c84e79af415fe05ec675deda151f_JaffaCakes118
Size

92KB
Sample

240709-sb6zrayhlm
MD5

30d7c84e79af415fe05ec675deda151f
SHA1

300b807b9f3954050f224b84fc6c4a44dd0eb0fb
SHA256

f2c40cc7ca758ca1739986c7151989daaeea44d7f65cbe8cc565879b21b5dbc5
SHA512

058207b1a7653fea5fb1f4da2c9a44406c62e1f664c5ea317876657b362d224249716d678830d11ada3b76c72fd075313fadbe1f2648651eb23d2f86c83ef130
SSDEEP

1536:vVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE3:XnxwgxgfR/DVG7wBpE3

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

30d7c84e79af415fe05ec675deda151f_JaffaCakes118.exe

Resource

win7-20240708-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

30d7c84e79af415fe05ec675deda151f_JaffaCakes118.exe

Resource

win10v2004-20240704-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  30d7c84e79af415fe05ec675deda151f_JaffaCakes118
- Size
  
  92KB
- MD5
  
  30d7c84e79af415fe05ec675deda151f
- SHA1
  
  300b807b9f3954050f224b84fc6c4a44dd0eb0fb
- SHA256
  
  f2c40cc7ca758ca1739986c7151989daaeea44d7f65cbe8cc565879b21b5dbc5
- SHA512
  
  058207b1a7653fea5fb1f4da2c9a44406c62e1f664c5ea317876657b362d224249716d678830d11ada3b76c72fd075313fadbe1f2648651eb23d2f86c83ef130
- SSDEEP
  
  1536:vVZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApE3:XnxwgxgfR/DVG7wBpE3
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy