ramnit | 7d102ee5b6814fe26ca865938848ffa3db1061e6e683c5637e5c11beb257d550 | Triage

Sharing

General

Target

JaffaCakes118_0008385427c02ec75fde6fb5f8fa1da4
Size

296KB
Sample

241231-b6b97axngr
MD5

0008385427c02ec75fde6fb5f8fa1da4
SHA1

bb7a6683c933f874905a651c86bca33be436bfd7
SHA256

7d102ee5b6814fe26ca865938848ffa3db1061e6e683c5637e5c11beb257d550
SHA512

b8b3c0b0da26b901d8104498d951194f5653c6dabec9c27eecea407f3373c43c5eef502f52726e4ada259aa03391a241b3e3af52404e12e5369b0aa2bc7c0f3f
SSDEEP

6144:zka3JDB+ISjbaWkcmU4HpkBYY3xAIo8Il405AlpLZhcnsmMXl7C81M3dR1lOeFal:wa3JDB+ISjbaWkcmU4HpkBYY3xAIo8Iv

Score

10^/10

ramnit banker discovery evasion persistence spyware stealer trojan worm

Malware Config

Targets

- Target
  
  JaffaCakes118_0008385427c02ec75fde6fb5f8fa1da4
- Size
  
  296KB
- MD5
  
  0008385427c02ec75fde6fb5f8fa1da4
- SHA1
  
  bb7a6683c933f874905a651c86bca33be436bfd7
- SHA256
  
  7d102ee5b6814fe26ca865938848ffa3db1061e6e683c5637e5c11beb257d550
- SHA512
  
  b8b3c0b0da26b901d8104498d951194f5653c6dabec9c27eecea407f3373c43c5eef502f52726e4ada259aa03391a241b3e3af52404e12e5369b0aa2bc7c0f3f
- SSDEEP
  
  6144:zka3JDB+ISjbaWkcmU4HpkBYY3xAIo8Il405AlpLZhcnsmMXl7C81M3dR1lOeFal:wa3JDB+ISjbaWkcmU4HpkBYY3xAIo8Iv
Score

10^/10

ramnit banker discovery evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- UAC bypass
  evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerdiscoveryevasionspywarestealertrojanworm