ramnit | 120b1b19c8996a3952f7f2fa0a295b299e2e8f541b6c6b5daa9a679282766dd0 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

e08aa3553e...18.exe

windows7-x64

3

e08aa3553e...18.exe

windows10-2004-x64

Sharing

General

Target

e08aa3553ee29a4ea199a73bcd74ef40_JaffaCakes118
Size

168KB
Sample

240914-tlbf9stanb
MD5

e08aa3553ee29a4ea199a73bcd74ef40
SHA1

8ed6660ada2cfd7d5d3341485c19a55fed95c132
SHA256

120b1b19c8996a3952f7f2fa0a295b299e2e8f541b6c6b5daa9a679282766dd0
SHA512

ad604603211bd78650cbdeff389d54ad7d0451523664f0f1618b57ca22687ba5acf018167497eb686641dc5ceba8ca3bcd266862576e88a51ba0c4840e81ea13
SSDEEP

3072:OkVDpBSqao9c3HwsanTdgyOxsP+f+vmdtT6J5l9ymiOm7neQcLl:7Sqjc3HsTaxoqYjlgh9beQc

Score

10^/10

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e08aa3553ee29a4ea199a73bcd74ef40_JaffaCakes118.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

e08aa3553ee29a4ea199a73bcd74ef40_JaffaCakes118.exe

Resource

win10v2004-20240802-en

ramnit sality backdoor banker discovery evasion spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Targets

- Target
  
  e08aa3553ee29a4ea199a73bcd74ef40_JaffaCakes118
- Size
  
  168KB
- MD5
  
  e08aa3553ee29a4ea199a73bcd74ef40
- SHA1
  
  8ed6660ada2cfd7d5d3341485c19a55fed95c132
- SHA256
  
  120b1b19c8996a3952f7f2fa0a295b299e2e8f541b6c6b5daa9a679282766dd0
- SHA512
  
  ad604603211bd78650cbdeff389d54ad7d0451523664f0f1618b57ca22687ba5acf018167497eb686641dc5ceba8ca3bcd266862576e88a51ba0c4840e81ea13
- SSDEEP
  
  3072:OkVDpBSqao9c3HwsanTdgyOxsP+f+vmdtT6J5l9ymiOm7neQcLl:7Sqjc3HsTaxoqYjlgh9beQc
Score

10^/10

discovery ramnit sality backdoor banker evasion spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- UAC bypass
  evasion trojan
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

ramnitsalitybackdoorbankerdiscoveryevasionspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy