ramnit | 21e71438dd2e8319feaf1bd939144c062eea9cd2c1ba495cfad836b6275adb35 | Triage

Submit
Reports

Overview

overview

Static

static

3

de3ff065ec...18.dll

windows7-x64

de3ff065ec...18.dll

windows10-2004-x64

Sharing

General

Target

de3ff065ec4de0d5cd9a079d84c64703_JaffaCakes118
Size

166KB
Sample

240913-nj8fbszajl
MD5

de3ff065ec4de0d5cd9a079d84c64703
SHA1

d4ee36dc03ff3af1e1fd294ffdb3c62cd449ec87
SHA256

21e71438dd2e8319feaf1bd939144c062eea9cd2c1ba495cfad836b6275adb35
SHA512

cb70729197fe8048ac0d8721dbfd4adc2f364135d45529b9372b12ce1f36d9efb26e41462f638a1f9411628c8a58850c36a2bf53153afe9d74e6dcef1f1fbaab
SSDEEP

1536:K5lTUKCYmCgV5bT/2d1QYelTUvUxTp/WU4vBHIJ79b5DT13x1RPZxkhp:ETU56gVxj27NedUvUXeUm07D3vfPU

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

de3ff065ec4de0d5cd9a079d84c64703_JaffaCakes118.dll

Resource

win7-20240708-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

de3ff065ec4de0d5cd9a079d84c64703_JaffaCakes118.dll

Resource

win10v2004-20240802-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  de3ff065ec4de0d5cd9a079d84c64703_JaffaCakes118
- Size
  
  166KB
- MD5
  
  de3ff065ec4de0d5cd9a079d84c64703
- SHA1
  
  d4ee36dc03ff3af1e1fd294ffdb3c62cd449ec87
- SHA256
  
  21e71438dd2e8319feaf1bd939144c062eea9cd2c1ba495cfad836b6275adb35
- SHA512
  
  cb70729197fe8048ac0d8721dbfd4adc2f364135d45529b9372b12ce1f36d9efb26e41462f638a1f9411628c8a58850c36a2bf53153afe9d74e6dcef1f1fbaab
- SSDEEP
  
  1536:K5lTUKCYmCgV5bT/2d1QYelTUvUxTp/WU4vBHIJ79b5DT13x1RPZxkhp:ETU56gVxj27NedUvUXeUm07D3vfPU
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy