ramnit | cf4d29cadefdfc5507fa2e43a752814b7ceb994f91cff91160a2d6a919995871 | Triage

Sharing

General

Target

cf4d29cadefdfc5507fa2e43a752814b7ceb994f91cff91160a2d6a919995871N.exe
Size

716KB
Sample

250112-l1llsazpdm
MD5

5c6e90d88fdd742f1cda9ae7a2a93f70
SHA1

f35e2bd1a5dce0b71267e55f28b2c7572fdc0617
SHA256

cf4d29cadefdfc5507fa2e43a752814b7ceb994f91cff91160a2d6a919995871
SHA512

e362599b0d1dbf24a900e91382ea50f43228f24a27cd17c5a03fb868b0b177cfcfe349dcef767d496cf327cc225bbbce664c41b4e55a9be4096322245abbed4b
SSDEEP

12288:TvqSyJda/aulZAuYL901/gWxiEGwyCoq/MsLAd:jUJdaLbY+oGiiX/FAd

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Malware Config

Targets

- Target
  
  cf4d29cadefdfc5507fa2e43a752814b7ceb994f91cff91160a2d6a919995871N.exe
- Size
  
  716KB
- MD5
  
  5c6e90d88fdd742f1cda9ae7a2a93f70
- SHA1
  
  f35e2bd1a5dce0b71267e55f28b2c7572fdc0617
- SHA256
  
  cf4d29cadefdfc5507fa2e43a752814b7ceb994f91cff91160a2d6a919995871
- SHA512
  
  e362599b0d1dbf24a900e91382ea50f43228f24a27cd17c5a03fb868b0b177cfcfe349dcef767d496cf327cc225bbbce664c41b4e55a9be4096322245abbed4b
- SSDEEP
  
  12288:TvqSyJda/aulZAuYL901/gWxiEGwyCoq/MsLAd:jUJdaLbY+oGiiX/FAd
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm