ramnit | b2e14f728e48d5e8af9ab549f2acbfc43d5658cef45d3ab5995f692faadba93d | Triage

Sharing

General

Target

b2e14f728e48d5e8af9ab549f2acbfc43d5658cef45d3ab5995f692faadba93d.exe
Size

217KB
Sample

250102-fd6esatpc1
MD5

81df241f83c6b3e132aced3674cc04a2
SHA1

f92df37b08ede45fdfd9783b8d141e6096910e8e
SHA256

b2e14f728e48d5e8af9ab549f2acbfc43d5658cef45d3ab5995f692faadba93d
SHA512

4351f8d226e4c451fc2b29fd690b0fa91dd9400c702fea234d1bf334b3ce8668d9a997861eb41e57ef109b07bc7273ca0e3d706a339fb205e988e0703e53ce44
SSDEEP

3072:dJrbZyR5YUyyvY/RjQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpK:dJrbZyi/WLBf0dJ5TTBZbspom7bXU

Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  b2e14f728e48d5e8af9ab549f2acbfc43d5658cef45d3ab5995f692faadba93d.exe
- Size
  
  217KB
- MD5
  
  81df241f83c6b3e132aced3674cc04a2
- SHA1
  
  f92df37b08ede45fdfd9783b8d141e6096910e8e
- SHA256
  
  b2e14f728e48d5e8af9ab549f2acbfc43d5658cef45d3ab5995f692faadba93d
- SHA512
  
  4351f8d226e4c451fc2b29fd690b0fa91dd9400c702fea234d1bf334b3ce8668d9a997861eb41e57ef109b07bc7273ca0e3d706a339fb205e988e0703e53ce44
- SSDEEP
  
  3072:dJrbZyR5YUyyvY/RjQLBvBt0M1qCWzJP0ruTTBaClHpspom7ffrAmpK:dJrbZyi/WLBf0dJ5TTBZbspom7bXU
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

discoveryevasionupx