ramnit | 25a2c7410eb0c4cc5b0c8e04d8463f2b13a00e08b991fe9e398d32bb9c32f81d | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...24.exe

windows7-x64

JaffaCakes...24.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_7705e861e12db869c9a318328179fc24
Size

123KB
Sample

250116-p8pvysslfr
MD5

7705e861e12db869c9a318328179fc24
SHA1

917ad00a5beb8824d23fe6bae3338aa0ff2551c6
SHA256

25a2c7410eb0c4cc5b0c8e04d8463f2b13a00e08b991fe9e398d32bb9c32f81d
SHA512

db2af1faa0ba319fda77935391f2e88ae50ec15d4b8d4e37437cc7691e7638206d4b3336fa8fcc7b5cbb31debf246e59c4177b68d6a4b058ee62b611fa2e5ae8
SSDEEP

768:f06R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:FR0Zn3Pc0LCH9MtbvabUDzJYWu3B

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_7705e861e12db869c9a318328179fc24.exe

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_7705e861e12db869c9a318328179fc24.exe

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_7705e861e12db869c9a318328179fc24
- Size
  
  123KB
- MD5
  
  7705e861e12db869c9a318328179fc24
- SHA1
  
  917ad00a5beb8824d23fe6bae3338aa0ff2551c6
- SHA256
  
  25a2c7410eb0c4cc5b0c8e04d8463f2b13a00e08b991fe9e398d32bb9c32f81d
- SHA512
  
  db2af1faa0ba319fda77935391f2e88ae50ec15d4b8d4e37437cc7691e7638206d4b3336fa8fcc7b5cbb31debf246e59c4177b68d6a4b058ee62b611fa2e5ae8
- SSDEEP
  
  768:f06R0UtgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:FR0Zn3Pc0LCH9MtbvabUDzJYWu3B
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy