ramnit | 5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9 | Triage

Submit
Reports

Overview

overview

Static

static

3

5ce23b2a95...e9.dll

windows7-x64

5ce23b2a95...e9.dll

windows10-2004-x64

Sharing

General

Target

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe
Size

276KB
Sample

241217-dpe1vszlap
MD5

d713d347658a4744e01eb2f9e169ce1c
SHA1

77777460a0b41f505de6cf8a3144b64df87ba01b
SHA256

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9
SHA512

387d0ab83c48d45ab3bc9abf7f5b0d9dc5b7a04944d2d319bb4d2978630829cd369bda6349737ca67980856a0a76a2279892d67134a96e1acbb47b6e7e64b5a1
SSDEEP

3072:FdcQ2ZNMSQvbajUTUItjT68+xQEVulys593oI8mmwXrPbh:VATSOjUQKculy8uI9fbPN

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.dll

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe
- Size
  
  276KB
- MD5
  
  d713d347658a4744e01eb2f9e169ce1c
- SHA1
  
  77777460a0b41f505de6cf8a3144b64df87ba01b
- SHA256
  
  5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9
- SHA512
  
  387d0ab83c48d45ab3bc9abf7f5b0d9dc5b7a04944d2d319bb4d2978630829cd369bda6349737ca67980856a0a76a2279892d67134a96e1acbb47b6e7e64b5a1
- SSDEEP
  
  3072:FdcQ2ZNMSQvbajUTUItjT68+xQEVulys593oI8mmwXrPbh:VATSOjUQKculy8uI9fbPN
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy