Overview

overview

10

Static

static

3

946d136996...18.dll

windows7-x64

10

946d136996...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    946d13699644003829f03ccd7196914a_JaffaCakes118

  • Size

    166KB

  • Sample

    240813-x7d13asbmd

  • MD5

    946d13699644003829f03ccd7196914a

  • SHA1

    23a80479e8f8d8a4e763acf10394848a7284dfb6

  • SHA256

    24990edca94344276bb3a2f3a2697330c59a7f480c53ab8d87e0f4e3745267ca

  • SHA512

    88d70dc8d3cbfa822932e9696217255baabf4a6338ddc7cf72843eb4084c2d8b750fabf9482b4984f0fe3d157a1d45293c509688ff60792165b56633d9f02fe6

  • SSDEEP

    3072:MTU56gVxj27NerMWO6nL+AF7quHOT0JqLPoAt:f48nqAeoqLxt

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      946d13699644003829f03ccd7196914a_JaffaCakes118

    • Size

      166KB

    • MD5

      946d13699644003829f03ccd7196914a

    • SHA1

      23a80479e8f8d8a4e763acf10394848a7284dfb6

    • SHA256

      24990edca94344276bb3a2f3a2697330c59a7f480c53ab8d87e0f4e3745267ca

    • SHA512

      88d70dc8d3cbfa822932e9696217255baabf4a6338ddc7cf72843eb4084c2d8b750fabf9482b4984f0fe3d157a1d45293c509688ff60792165b56633d9f02fe6

    • SSDEEP

      3072:MTU56gVxj27NerMWO6nL+AF7quHOT0JqLPoAt:f48nqAeoqLxt

    Score
    10/10
    ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks