ramnit | bb07d8062c1c98968af2dadb968f18c823a96f3239b3e03ab985fc31cba2deb6 | Triage

Sharing

General

Target

JaffaCakes118_7b5efe1b6daebecf79db2d5df320048f
Size

132KB
Sample

250104-x42b7atkby
MD5

7b5efe1b6daebecf79db2d5df320048f
SHA1

7ef0c14ffa32b711e6f8ae76a1f8afa5c0934387
SHA256

bb07d8062c1c98968af2dadb968f18c823a96f3239b3e03ab985fc31cba2deb6
SHA512

07bb0c0a761432ec053050f14ebc15b8530b1586c7b7b29cafb729261f980d34b9c803508af2c34d76eec2af9cc6aa2ffc1a0207219b3f4159b7bde984c0127a
SSDEEP

3072:zwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8Enopn:zMzzILGFkzhr0pGj9oEcn

Score

10^/10

ramnit banker discovery evasion spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  JaffaCakes118_7b5efe1b6daebecf79db2d5df320048f
- Size
  
  132KB
- MD5
  
  7b5efe1b6daebecf79db2d5df320048f
- SHA1
  
  7ef0c14ffa32b711e6f8ae76a1f8afa5c0934387
- SHA256
  
  bb07d8062c1c98968af2dadb968f18c823a96f3239b3e03ab985fc31cba2deb6
- SHA512
  
  07bb0c0a761432ec053050f14ebc15b8530b1586c7b7b29cafb729261f980d34b9c803508af2c34d76eec2af9cc6aa2ffc1a0207219b3f4159b7bde984c0127a
- SSDEEP
  
  3072:zwV4OgSzBmh04eZFkz3Rr0gwGj9Tf8Enopn:zMzzILGFkzhr0pGj9oEcn
Score

10^/10

ramnit banker spyware stealer trojan upx worm discovery evasion
- Modifies firewall policy service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Drops file in Drivers directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

discoveryevasionupx