ramnit | 79d32b9dedafb896a9d4e72931a1150bd636c4ede44e7d9b66a836870960dace | Triage

Sharing

General

Target

JaffaCakes118_4043e7a3ec462e9cfa8ff47f6f7c5af0
Size

511KB
Sample

250101-af7gzayqfl
MD5

4043e7a3ec462e9cfa8ff47f6f7c5af0
SHA1

194394367effa041a33e213357921eb2400494aa
SHA256

79d32b9dedafb896a9d4e72931a1150bd636c4ede44e7d9b66a836870960dace
SHA512

82e12eebf0fbe561a60f4aa24b51839b4ce2296934ae56deaaf6b5077e7a5f6fd15724029a53d895ea02f66a7f3fd2c358bf08e790124815a7f4b792f840d87b
SSDEEP

6144:iSAshdo/MCRiVFAr5V2uG99GUc4Y5DDUXMfv0s9uivOc0mUTQx2iumBNTw:b4MM5V2uGvGUcdNDU8h9uim30xBtjTw

Score

10^/10

ramnit banker discovery evasion persistence spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  JaffaCakes118_4043e7a3ec462e9cfa8ff47f6f7c5af0
- Size
  
  511KB
- MD5
  
  4043e7a3ec462e9cfa8ff47f6f7c5af0
- SHA1
  
  194394367effa041a33e213357921eb2400494aa
- SHA256
  
  79d32b9dedafb896a9d4e72931a1150bd636c4ede44e7d9b66a836870960dace
- SHA512
  
  82e12eebf0fbe561a60f4aa24b51839b4ce2296934ae56deaaf6b5077e7a5f6fd15724029a53d895ea02f66a7f3fd2c358bf08e790124815a7f4b792f840d87b
- SSDEEP
  
  6144:iSAshdo/MCRiVFAr5V2uG99GUc4Y5DDUXMfv0s9uivOc0mUTQx2iumBNTw:b4MM5V2uGvGUcdNDU8h9uim30xBtjTw
Score

10^/10

ramnit banker discovery evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryevasionpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryevasionpersistencespywarestealertrojanupxworm