Overview

overview

10

Static

static

3

JaffaCakes...1d.dll

windows7-x64

10

JaffaCakes...1d.dll

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_0f279f6b5a37f17af18161ce5bad3a1d

  • Size

    436KB

  • Sample

    250122-tb1cmsvlhn

  • MD5

    0f279f6b5a37f17af18161ce5bad3a1d

  • SHA1

    b160925583de432c9946d7949947869554a48957

  • SHA256

    5aca77977b65a56f73a226e7fc52a84d22963326b54b24a01c72301db63b31fc

  • SHA512

    eeefcc3a7a0110ae039431b60848d2a9d86794c903e14ebfc38f8ba7576edc4318f9fec9f6bb4e18292aaaeaed4def0f6ac4d4ad1eafa63c1d5d5a1f368830dc

  • SSDEEP

    6144:LcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlEjND7:Loz83OtIEzW+/m/AyF7bCrO/EjNGrUP

Score
10/10
ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      JaffaCakes118_0f279f6b5a37f17af18161ce5bad3a1d

    • Size

      436KB

    • MD5

      0f279f6b5a37f17af18161ce5bad3a1d

    • SHA1

      b160925583de432c9946d7949947869554a48957

    • SHA256

      5aca77977b65a56f73a226e7fc52a84d22963326b54b24a01c72301db63b31fc

    • SHA512

      eeefcc3a7a0110ae039431b60848d2a9d86794c903e14ebfc38f8ba7576edc4318f9fec9f6bb4e18292aaaeaed4def0f6ac4d4ad1eafa63c1d5d5a1f368830dc

    • SSDEEP

      6144:LcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlEjND7:Loz83OtIEzW+/m/AyF7bCrO/EjNGrUP

    Score
    10/10
    ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Ramnit family

      ramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks