ramnit | 47694aad594291de973b3aa278bbf2c3caeaefa1899eb0d2d2e6523850e2c86b | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...13.dll

windows7-x64

JaffaCakes...13.dll

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_27bbf09f3db6e1b9e44d519ca14a2d13
Size

1.3MB
Sample

250125-dttd2svkdp
MD5

27bbf09f3db6e1b9e44d519ca14a2d13
SHA1

2ab8492398e5b3b29c7ba6b9f2c960dc1a58b182
SHA256

47694aad594291de973b3aa278bbf2c3caeaefa1899eb0d2d2e6523850e2c86b
SHA512

abfa41c0c08f2fc99d4cc371782fdb070ab040258889c6c0ec97cb3aca8f3dec36976c9f66adad555326f6f4ae9b936146131cf7822bdb58336c452f8ffb9602
SSDEEP

12288:p9g8GZHpzAac5naAd25L5O+FQ7lW8lZ60ICPxaf6og38BfSH6gqrandxT+is3pjf:p68+O6pvbt/wuzTB2OF+3xc1

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_27bbf09f3db6e1b9e44d519ca14a2d13.dll

Resource

win7-20240903-en

ramnit banker discovery spyware stealer trojan upx worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_27bbf09f3db6e1b9e44d519ca14a2d13.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_27bbf09f3db6e1b9e44d519ca14a2d13
- Size
  
  1.3MB
- MD5
  
  27bbf09f3db6e1b9e44d519ca14a2d13
- SHA1
  
  2ab8492398e5b3b29c7ba6b9f2c960dc1a58b182
- SHA256
  
  47694aad594291de973b3aa278bbf2c3caeaefa1899eb0d2d2e6523850e2c86b
- SHA512
  
  abfa41c0c08f2fc99d4cc371782fdb070ab040258889c6c0ec97cb3aca8f3dec36976c9f66adad555326f6f4ae9b936146131cf7822bdb58336c452f8ffb9602
- SSDEEP
  
  12288:p9g8GZHpzAac5naAd25L5O+FQ7lW8lZ60ICPxaf6og38BfSH6gqrandxT+is3pjf:p68+O6pvbt/wuzTB2OF+3xc1
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy