rammm-main.zip
- SHA256 9dff7bdbf628a35a24c1ac936bcea1637e2d83cab257f473d4312eb8490484e4
Behavioral task
behavioral1
Sample
rammm-main/file.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
rammm-main/file.exe
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
rammm-main/file.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target rammm-main.zip
- Size 557KB
- Sample260519-js35rag171
- SHA256 9dff7bdbf628a35a24c1ac936bcea1637e2d83cab257f473d4312eb8490484e4
- MD5 45f3730255c7be9f51d8c69d86362a55
- SHA1 a733323e8d73ec73c6c78375dc08c92ebd77a503
- SHA512 d1fa86a4b4de4a8c053eab6ac8d8c9b5b33429bcdc26e905719c86b720a9a80b49a32788a09818d7fea15530cd2f5c64aff457908f1c354ef2db488e19aca319
- SSDEEP 12288:n2KJJW92vLaOe1QcBbcBPMwUgdsApmOHCncPZjE:+9+LbyQMOPIgdsAXC
- TLSH T10AC4230CBDAE4C2A89EF14C39894C12F8DA88911955F4875DE7FCAE57FD00B7B60582E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
File Explorer
-
rammm-main.zip.zip 557KB
-
rammm-main/file.exe.exe 1.2MB
-
rammm-main/file.ps1.ps1 .js 7KB
-
rammm-main/shellcode.bin483KB
rammm-main/file.exe
- IMPHASH 0a98343311b070c6ce1a4debb2e92254
- SHA256 83dc1316a2a9f515187cd82024fd616d85f4fd9b8880a2a0b2480216a97bab24
- MD5 4ec99b4bcf6e8475d157dacb3f213503
- SHA1 a4ffe5659d4f43b20ccf6392f2a0f9b3df418e7a
- SHA512 a31e42f5cca2fbda38275cb48baa6ef9abc1e3569dced08ca6c9641261a0094c954537b80d0b1b7e6448f1a82cafdd695507e5c4ececfcfcb021b0837fbfe496
- SSDEEP 12288:d+H1DSds3T9fZBIYRNY3EfxnXxModXRSiXhkypdQwcmeyIvw9E8:ySds3T9xiodXROypdQwc1I9E
- TLSH T1CC55A54BE7B611D1F4BAC139A562322AFC7234A58738D7D792859A0E5B30FE4AD3D700
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
480811
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Hasan\Downloads\LOloveeni\file\x64\Debug\file.pdb
kernel32
CreateFileA
WriteFile
CloseHandle
CreateProcessA
CreateFileW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
GetModuleFileNameW
LoadLibraryExW
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
GetCurrentProcess
TerminateProcess
GetModuleHandleExW
HeapSize
HeapValidate
GetSystemInfo
GetStdHandle
ExitProcess
GetCommandLineA
GetCommandLineW
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
GetFileType
OutputDebugStringW
WriteConsoleW
SetConsoleCtrlHandler
GetTempPathW
IsThreadAFiber
VirtualProtect
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
GetCurrentThread
HeapQueryInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
RtlUnwind
wininet
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
Name
.textbss
Size
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
985KB
Virtual Size
984KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.msvcjmc
Size
1024B
Virtual Size
535B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.00cfg
Size
512B
Virtual Size
373B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
1024B
Virtual Size
563B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=149, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35403,
count=17, id=260, version=35403,
count=51, id=261, version=35403,
count=5, id=257, version=33145,
count=97, id=1, productName=Unmarked objects,
count=1, id=261, version=35728,
count=1, id=255, version=35728,
count=1, id=258, version=35728,
rammm-main/file.ps1
- SHA256 930a0ee28bf06c7b94509b61a49a374d29880611f81b05bad6559d445802d7d9
- MD5 b56451fe65bba9b74978b29d13632f07
- SHA1 d62dba0fed85475664ae909e90533fc4cf082a77
- SHA512 33b91bfa25a22c307bdb332be8c9314dbcd60ba2c38fad0741e501aef13e6a913c065718c4d8c6448c44f85caeb6e6912bd5056b9bb898b9da36774b14df35e4
- SSDEEP 96:F9o11ft+114VSIoNckF073kmBWX/wAkqU1u2xBeH5af8nJLdE:x14VSId3u/wA7UZxsH5T6
- TLSH T1A9F122384208576949B2226AAB48C549FA5741F30BBF2E51F8CC82355F7605DE13AFFA
- MD5 SHA1 SHA512 SSDEEP TLSH
rammm-main/shellcode.bin
- SHA256 c153d0f46fb7f36c4361f3e3644df2a42ab90c8eeaa2a7adbf4142109217994a
- MD5 cc36627286b4acdd016f1aee33bad872
- SHA1 bf607a55bf908bc7f604da48884da35395ca16f9
- SHA512 995e8ec77d0c0514236f617e6d3e7a72776880af1ff57aac3c45be0f9531112d58d446499430da2d8168911fa28bd525395e95d5111a9a26d0d6227c9464f1a2
- SSDEEP 12288:bu/RNcGGDk5vS6TShCfwxC9BC6gsPZr5:b6uGWktSswxCPj7Z
- TLSH T174B4AE02B6C2C0B2D57E15300425D775DEFCBD21187D9D7BA3EA0D6BFE70180AA39A66
- MD5 SHA1 SHA512 SSDEEP TLSH