ramnit | ae4b706678e6e22a9ab570f26d314cd2ad20e4280042592489e15a02d9970de0 | Triage

Submit
Reports

Overview

overview

Static

static

3

89482da238...18.exe

windows7-x64

89482da238...18.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target

89482da238d334f25a7f751c86e0c675_JaffaCakes118
Size

568KB
Sample

240811-gtn14ssbjc
MD5

89482da238d334f25a7f751c86e0c675
SHA1

900713240e390c330a0112006f494e52895820b0
SHA256

ae4b706678e6e22a9ab570f26d314cd2ad20e4280042592489e15a02d9970de0
SHA512

7190519585f13bd2ed8c56b407bdbd0a47679ac8f607e8de9cb400178d3a5e0988aadc67ef5573fbc49f2b1bb98a2b54ce49354131a9e7ff0a63ad89d3b4fbcf
SSDEEP

12288:XgHy9zoijsIvRCO7lhyj3nLSTBnxmncFMBCwaODxRSqCRxh51:rqERC8lhM3nGTBnxgCShcH

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

89482da238d334f25a7f751c86e0c675_JaffaCakes118.exe

Resource

win7-20240704-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

89482da238d334f25a7f751c86e0c675_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery persistence upx

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  89482da238d334f25a7f751c86e0c675_JaffaCakes118
- Size
  
  568KB
- MD5
  
  89482da238d334f25a7f751c86e0c675
- SHA1
  
  900713240e390c330a0112006f494e52895820b0
- SHA256
  
  ae4b706678e6e22a9ab570f26d314cd2ad20e4280042592489e15a02d9970de0
- SHA512
  
  7190519585f13bd2ed8c56b407bdbd0a47679ac8f607e8de9cb400178d3a5e0988aadc67ef5573fbc49f2b1bb98a2b54ce49354131a9e7ff0a63ad89d3b4fbcf
- SSDEEP
  
  12288:XgHy9zoijsIvRCO7lhyj3nLSTBnxmncFMBCwaODxRSqCRxh51:rqERC8lhM3nGTBnxgCShcH
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

discoverypersistenceupx

© 2018-2025

Terms | Privacy