ramnit | 4de88269a13f3e7c4c9627bea70f7f4b7e311ff97e75b0968b73a2829c69792d | Triage

Sharing

General

Target

JaffaCakes118_60dec9c29bcaf25f4a3ba15c6ce0d0b0
Size

212KB
Sample

250101-1smw7syndk
MD5

60dec9c29bcaf25f4a3ba15c6ce0d0b0
SHA1

d743f653c55c2fb256063b7a0e8c622ad5de2aae
SHA256

4de88269a13f3e7c4c9627bea70f7f4b7e311ff97e75b0968b73a2829c69792d
SHA512

0987982d737b50e7c00c9850bf4b630c5973d2d500b023d7976d63f3c20e8bfb5a778289fe98c74899963af2a174d10b4a13db20244cec66b5333b74840bdf8f
SSDEEP

3072:WwV4OgSzBmh04eZFkz3Rr0gwGj9Tf895bxpd4v1sqW9dpnIF8RZ/1/a:WMzzILGFkzhr0pGj9o9592sqQdKkt

Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  JaffaCakes118_60dec9c29bcaf25f4a3ba15c6ce0d0b0
- Size
  
  212KB
- MD5
  
  60dec9c29bcaf25f4a3ba15c6ce0d0b0
- SHA1
  
  d743f653c55c2fb256063b7a0e8c622ad5de2aae
- SHA256
  
  4de88269a13f3e7c4c9627bea70f7f4b7e311ff97e75b0968b73a2829c69792d
- SHA512
  
  0987982d737b50e7c00c9850bf4b630c5973d2d500b023d7976d63f3c20e8bfb5a778289fe98c74899963af2a174d10b4a13db20244cec66b5333b74840bdf8f
- SSDEEP
  
  3072:WwV4OgSzBmh04eZFkz3Rr0gwGj9Tf895bxpd4v1sqW9dpnIF8RZ/1/a:WMzzILGFkzhr0pGj9o9592sqQdKkt
Score

10^/10

ramnit banker spyware stealer trojan upx worm discovery evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

discoveryevasionupx