ramnit | 9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46 | Triage

Submit
Reports

Overview

overview

Static

static

3

9b288eda44...46.dll

windows7-x64

9b288eda44...46.dll

windows10-2004-x64

Sharing

General

Target

9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46
Size

496KB
Sample

241217-bkwrpswje1
MD5

d7b399149f64c090b6c255f2879ce047
SHA1

3d9fa465988b60fd0453ee1a6c97fa59c36c237f
SHA256

9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46
SHA512

861872a8a7e3c443bf3a00cc97e84566c9b3828d733174c8b872890790f46f0c34a987965bd10f49341712095a0ba9c7acf88617edfb5542ac6b2c028a02f6c1
SSDEEP

12288:mehnaNPpSVZmNxRCwnwm3W3OHIIf5+UUHz1z8:meh0PpS6NxNnwYeOHXRUHhz8

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46.dll

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46
- Size
  
  496KB
- MD5
  
  d7b399149f64c090b6c255f2879ce047
- SHA1
  
  3d9fa465988b60fd0453ee1a6c97fa59c36c237f
- SHA256
  
  9b288eda44b79787a3bc2afe673c735ba27405d88242306ee174c48a9e76ff46
- SHA512
  
  861872a8a7e3c443bf3a00cc97e84566c9b3828d733174c8b872890790f46f0c34a987965bd10f49341712095a0ba9c7acf88617edfb5542ac6b2c028a02f6c1
- SSDEEP
  
  12288:mehnaNPpSVZmNxRCwnwm3W3OHIIf5+UUHz1z8:meh0PpS6NxNnwYeOHXRUHhz8
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy