ramnit | 488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca | Triage

Submit
Reports

Overview

overview

Static

static

3

488e75e28e...ca.dll

windows7-x64

488e75e28e...ca.dll

windows10-2004-x64

Sharing

General

Target

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.exe
Size

212KB
Sample

241219-ft23as1jen
MD5

84c79a31b6ec4ddfb8af38bd82e397a9
SHA1

5e8193d5438395bdb58636954f3841d56526a7f2
SHA256

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca
SHA512

ba9081b58d6e0dbb6126f01452d243e18ccddbab4bd068fd9a7db56d752509c24c0847e0a8055e582537ba78a19d0620f1d9726d76e42f8e32cda9a4e02b12a2
SSDEEP

3072:an4cV8gf2u41Z5tKlwiIhKQGUppd4/nPxh:g4y8gOl2nIcNEdexh

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.dll

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

12 signatures

120 seconds

Behavioral task

behavioral2

Sample

488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca.exe
- Size
  
  212KB
- MD5
  
  84c79a31b6ec4ddfb8af38bd82e397a9
- SHA1
  
  5e8193d5438395bdb58636954f3841d56526a7f2
- SHA256
  
  488e75e28ed648af7738686a6c2ffc7b146c7ade30ee47dabe52bda4c4a9eeca
- SHA512
  
  ba9081b58d6e0dbb6126f01452d243e18ccddbab4bd068fd9a7db56d752509c24c0847e0a8055e582537ba78a19d0620f1d9726d76e42f8e32cda9a4e02b12a2
- SSDEEP
  
  3072:an4cV8gf2u41Z5tKlwiIhKQGUppd4/nPxh:g4y8gOl2nIcNEdexh
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2024

Terms | Privacy