ramnit | 89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5 | Triage

Submit
Reports

Overview

overview

Static

static

7

89ab03c259...5N.dll

windows7-x64

89ab03c259...5N.dll

windows10-2004-x64

7

Sharing

General

Target

89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5N.exe
Size

187KB
Sample

241216-xz5ttayqbp
MD5

6c601b488da0c9055c185ee67d81ae10
SHA1

d4e564ae5c4d899bd52c880c4fbec32642e273a2
SHA256

89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5
SHA512

3f2f3907fdb0ef2de08bd8ce774115305639af63afe0f663c196b4bb6afa42b8e54f0d9eef426149b8b1b8b79a603fa708f59d2bd4e7d9ebf01f09f96464bc8b
SSDEEP

3072:jKuoYY+RoatpaNj+FIlYGTuXHHetkqcqvnhzduz:+OY+cjuQTuXHHel/Vgz

Score

10^/10

ramnit banker discovery spyware stealer trojan upx vmprotect worm

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5N.dll

Resource

win7-20240903-en

ramnit banker discovery spyware stealer trojan upx worm

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5N.dll

Resource

win10v2004-20241007-en

discovery upx vmprotect

windows10-2004-x64

7 signatures

120 seconds

Malware Config

Targets

- Target
  
  89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5N.exe
- Size
  
  187KB
- MD5
  
  6c601b488da0c9055c185ee67d81ae10
- SHA1
  
  d4e564ae5c4d899bd52c880c4fbec32642e273a2
- SHA256
  
  89ab03c259222ee0348360a6d6670d5db5d95da04778747b2ef8563c3bacfdf5
- SHA512
  
  3f2f3907fdb0ef2de08bd8ce774115305639af63afe0f663c196b4bb6afa42b8e54f0d9eef426149b8b1b8b79a603fa708f59d2bd4e7d9ebf01f09f96464bc8b
- SSDEEP
  
  3072:jKuoYY+RoatpaNj+FIlYGTuXHHetkqcqvnhzduz:+OY+cjuQTuXHHel/Vgz
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm vmprotect
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

discoveryupxvmprotect

© 2018-2024

Terms | Privacy