ramnit | 5336cde60af29e2e1d3b5f7d10a012eb3816b52ccbd7e1dcaf17eaa8eb95e7d2 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

730bffabef...18.exe

windows7-x64

730bffabef...18.exe

windows10-2004-x64

Sharing

General

Target

730bffabefb0d1d1c74da79de19c7ef2_JaffaCakes118
Size

271KB
Sample

240726-hxtlfatalj
MD5

730bffabefb0d1d1c74da79de19c7ef2
SHA1

56824949360104b176070c11b8ab7652213bafc2
SHA256

5336cde60af29e2e1d3b5f7d10a012eb3816b52ccbd7e1dcaf17eaa8eb95e7d2
SHA512

1d6be06d793e1e583a69f8014709e0d8c993b7b98e7648f54e395b1104df489d108756caeec0a86c44083a5eaf729a222a136d06e4bfcd3e8c4a169fd641649c
SSDEEP

3072:ri0kVD1BSqao9c3HwsanTdgyOxsP+f+1E8MJsgxtpo4d0iARBUAMm3ABDV:+BSqjc3HsTaxoqWMCg7C3TMm3kR

Score

10^/10

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

730bffabefb0d1d1c74da79de19c7ef2_JaffaCakes118.exe

Resource

win7-20240705-en

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

730bffabefb0d1d1c74da79de19c7ef2_JaffaCakes118.exe

Resource

win10v2004-20240709-en

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Targets

- Target
  
  730bffabefb0d1d1c74da79de19c7ef2_JaffaCakes118
- Size
  
  271KB
- MD5
  
  730bffabefb0d1d1c74da79de19c7ef2
- SHA1
  
  56824949360104b176070c11b8ab7652213bafc2
- SHA256
  
  5336cde60af29e2e1d3b5f7d10a012eb3816b52ccbd7e1dcaf17eaa8eb95e7d2
- SHA512
  
  1d6be06d793e1e583a69f8014709e0d8c993b7b98e7648f54e395b1104df489d108756caeec0a86c44083a5eaf729a222a136d06e4bfcd3e8c4a169fd641649c
- SSDEEP
  
  3072:ri0kVD1BSqao9c3HwsanTdgyOxsP+f+1E8MJsgxtpo4d0iARBUAMm3ABDV:+BSqjc3HsTaxoqWMCg7C3TMm3kR
Score

10^/10

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Windows security modification
  evasion trojan
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitsalitybackdoorbankerdiscoveryevasionspywarestealertrojanupxworm

behavioral2

ramnitsalitybackdoorbankerdiscoveryevasionspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy