ramnit | cb92007410ba11fa6bcefd23c8e0c8741c3f7469c5f20714a3b0b6895f0fea6f | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...50.dll

windows7-x64

JaffaCakes...50.dll

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_692efe0f0a2e1c3914f29dd480ce0550
Size

451KB
Sample

250103-azssxsskex
MD5

692efe0f0a2e1c3914f29dd480ce0550
SHA1

8c3ef6b92a3f6ff586313bb0406844b68d9b5464
SHA256

cb92007410ba11fa6bcefd23c8e0c8741c3f7469c5f20714a3b0b6895f0fea6f
SHA512

bd22e56fb9a5600d2f6586a6a600c34287a94142ddcd53d55919633334fbe7b7cbf3d163c6601c64fda7bd6a21db2ba531db2174ca038cc236453cb4031b8434
SSDEEP

12288:WU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvm0aL7+z:WSGB2uJ2s4otqFCJrW9FqvSbqsHasgXi

Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_692efe0f0a2e1c3914f29dd480ce0550.dll

Resource

win7-20240903-en

ramnit banker discovery evasion spyware stealer trojan upx worm

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_692efe0f0a2e1c3914f29dd480ce0550.dll

Resource

win10v2004-20241007-en

ramnit banker discovery evasion spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_692efe0f0a2e1c3914f29dd480ce0550
- Size
  
  451KB
- MD5
  
  692efe0f0a2e1c3914f29dd480ce0550
- SHA1
  
  8c3ef6b92a3f6ff586313bb0406844b68d9b5464
- SHA256
  
  cb92007410ba11fa6bcefd23c8e0c8741c3f7469c5f20714a3b0b6895f0fea6f
- SHA512
  
  bd22e56fb9a5600d2f6586a6a600c34287a94142ddcd53d55919633334fbe7b7cbf3d163c6601c64fda7bd6a21db2ba531db2174ca038cc236453cb4031b8434
- SSDEEP
  
  12288:WU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvm0aL7+z:WSGB2uJ2s4otqFCJrW9FqvSbqsHasgXi
Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryevasionspywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryevasionspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy