ramnit | 60f1af2b47786036ad2f16291e82da7b9b0d321450c1ef05a86b57a7ccb5cd07 | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...13.exe

windows7-x64

7

JaffaCakes...13.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_7a787470d6f62f1c877e9964fb86e513
Size

185KB
Sample

250104-s2gsjsvqes
MD5

7a787470d6f62f1c877e9964fb86e513
SHA1

91ca45995b111f61ff3582d70e45136bfe0d3c7e
SHA256

60f1af2b47786036ad2f16291e82da7b9b0d321450c1ef05a86b57a7ccb5cd07
SHA512

167aa5bb3586eb565a7de49b1f823a249fadcc9cab3aa04eb25639030a3778cd8fb756b6a801dbb6e596cf3b6844519200082aa70188c046aa219ee28bac55d3
SSDEEP

3072:nwX6yB0YfnMqh88W+RhjLRHzAA5/RWbzAlzS4wh1JEgxitBOQPYPfWaNNrqniOfQ:nNk0YfJhjVLYR/1KgjgfAe5RmpzT

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_7a787470d6f62f1c877e9964fb86e513.exe

Resource

win7-20241010-en

discovery persistence

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_7a787470d6f62f1c877e9964fb86e513.exe

Resource

win10v2004-20241007-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_7a787470d6f62f1c877e9964fb86e513
- Size
  
  185KB
- MD5
  
  7a787470d6f62f1c877e9964fb86e513
- SHA1
  
  91ca45995b111f61ff3582d70e45136bfe0d3c7e
- SHA256
  
  60f1af2b47786036ad2f16291e82da7b9b0d321450c1ef05a86b57a7ccb5cd07
- SHA512
  
  167aa5bb3586eb565a7de49b1f823a249fadcc9cab3aa04eb25639030a3778cd8fb756b6a801dbb6e596cf3b6844519200082aa70188c046aa219ee28bac55d3
- SSDEEP
  
  3072:nwX6yB0YfnMqh88W+RhjLRHzAA5/RWbzAlzS4wh1JEgxitBOQPYPfWaNNrqniOfQ:nNk0YfJhjVLYR/1KgjgfAe5RmpzT
Score

10^/10

discovery persistence ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

© 2018-2025

Terms | Privacy