Overview

overview

10

Static

static

3

7417e56c6a...18.dll

windows7-x64

10

7417e56c6a...18.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7417e56c6a61a030da6b2b02e43c0212_JaffaCakes118

  • Size

    436KB

  • Sample

    240726-pv4rysyann

  • MD5

    7417e56c6a61a030da6b2b02e43c0212

  • SHA1

    737e111aafc9266eb30d2320d198224c47f48bd4

  • SHA256

    04aba1e1ce3510173388654fc061eff6900583bfbb9c5f5db43b7d4d660028f5

  • SHA512

    ae26ec908ca93e118fa77b33c8926462e4e3075d843dc3374f28a0c9ee76e346293aae48789f814ebcd5fe54be338e084e0a2fb532446f05f7d1439373db96d7

  • SSDEEP

    6144:JcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlEFF5:Joz83OtIEzW+/m/AyF7bCrO/EFzCd

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      7417e56c6a61a030da6b2b02e43c0212_JaffaCakes118

    • Size

      436KB

    • MD5

      7417e56c6a61a030da6b2b02e43c0212

    • SHA1

      737e111aafc9266eb30d2320d198224c47f48bd4

    • SHA256

      04aba1e1ce3510173388654fc061eff6900583bfbb9c5f5db43b7d4d660028f5

    • SHA512

      ae26ec908ca93e118fa77b33c8926462e4e3075d843dc3374f28a0c9ee76e346293aae48789f814ebcd5fe54be338e084e0a2fb532446f05f7d1439373db96d7

    • SSDEEP

      6144:JcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlEFF5:Joz83OtIEzW+/m/AyF7bCrO/EFzCd

    Score
    10/10
    ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks