ramnit | 7373b05c6d36b5f825c635375746f20844c832ca5cf779836654d6eb46b38eed | Triage

Sharing

General

Target

7373b05c6d36b5f825c635375746f20844c832ca5cf779836654d6eb46b38eed.exe
Size

247KB
Sample

250101-zmne4swkfm
MD5

0e5944511bc6e0f701180e7cb035281c
SHA1

67eeb7cf46af7df12b06ae34affdedf87741e05b
SHA256

7373b05c6d36b5f825c635375746f20844c832ca5cf779836654d6eb46b38eed
SHA512

76d9006da3b6616ea993dac14341a9b90be16a0c0f980bdd81fc4eadb242ae98987c7e8b61477be8f5f7ec75562735bb1b0d9555aa6e039731b590109c053353
SSDEEP

3072:WPLE6h382ERPRDetLlr6mTr7QLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpC:WPHh2i9rULBf0dJ5TTBZbspom7bX4

Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  7373b05c6d36b5f825c635375746f20844c832ca5cf779836654d6eb46b38eed.exe
- Size
  
  247KB
- MD5
  
  0e5944511bc6e0f701180e7cb035281c
- SHA1
  
  67eeb7cf46af7df12b06ae34affdedf87741e05b
- SHA256
  
  7373b05c6d36b5f825c635375746f20844c832ca5cf779836654d6eb46b38eed
- SHA512
  
  76d9006da3b6616ea993dac14341a9b90be16a0c0f980bdd81fc4eadb242ae98987c7e8b61477be8f5f7ec75562735bb1b0d9555aa6e039731b590109c053353
- SSDEEP
  
  3072:WPLE6h382ERPRDetLlr6mTr7QLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpC:WPHh2i9rULBf0dJ5TTBZbspom7bX4
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

discoveryevasionupx