Overview

overview

10

Static

static

3

3302c0ea3d...18.exe

windows7-x64

10

3302c0ea3d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3302c0ea3da62f2eca1a8a13ddd22971_JaffaCakes118

  • Size

    7.4MB

  • Sample

    241011-dgqsdsxekj

  • MD5

    3302c0ea3da62f2eca1a8a13ddd22971

  • SHA1

    b4124d13ea819822246972a973402c3ce4d5be35

  • SHA256

    551d738e35f8c014d31e4f89edddb73ea085b04ea63c10c8ff34a79ef6110b54

  • SHA512

    5416dc46f1ac17668f03840b5e89a8b3631f5c05b02cfd5c18501a2182047cedc6f375e4409c386d1e7f7fb46724861893050c9745934115a05e3036f3e93d36

  • SSDEEP

    196608:ClAsCR/ZphLadEn/12We1FFkpqvmOCQom7xOJl:ClAL1FRn/7e1ahDQo+c

Score
10/10
ramnitrmsbankerdiscoveryratspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      3302c0ea3da62f2eca1a8a13ddd22971_JaffaCakes118

    • Size

      7.4MB

    • MD5

      3302c0ea3da62f2eca1a8a13ddd22971

    • SHA1

      b4124d13ea819822246972a973402c3ce4d5be35

    • SHA256

      551d738e35f8c014d31e4f89edddb73ea085b04ea63c10c8ff34a79ef6110b54

    • SHA512

      5416dc46f1ac17668f03840b5e89a8b3631f5c05b02cfd5c18501a2182047cedc6f375e4409c386d1e7f7fb46724861893050c9745934115a05e3036f3e93d36

    • SSDEEP

      196608:ClAsCR/ZphLadEn/12We1FFkpqvmOCQom7xOJl:ClAL1FRn/7e1ahDQo+c

    Score
    10/10
    ramnitrmsbankerdiscoveryratspywarestealertrojanupxworm

    • RMS

      Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.

      trojanratrms

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks