ramnit | c207b62972589c9651a04eeb21b48d337f7c9bd9b942c6f61538faa18707b0f8 | Triage™

Login
Reports

Overview

overview

Static

static

3

jaffacakes....a.exe

windows10-2004-x64

jaffacakes....a.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_Virus.Win32.Nimnul.a.35018ba9753c4a3fb33b0
Size 1.3MB
Sample261018-ta2jbaf13s
SHA256 c207b62972589c9651a04eeb21b48d337f7c9bd9b942c6f61538faa18707b0f8
MD5 a8070e526f135018ba9753c4a3fb33b0
SHA1 965c0f5a72041118d38ae500f3ce547ce87915d9
SHA512 91b05568840f3e6458f58db89f06dee61e8ed53eccf28b914c8eed6381e1abaf7ccbbd0097f870bc74522c3f1025b5a75084756f68e4c603336e203dd3c00ff8
SSDEEP 12288:FqOPajQUXXP8QvLWFx6Mo5rippDC7ee1hpls4Ey+rzk7zYdBNn:FnajQEPnvg6PhWDC750vk7Cp
TLSH
T153555C40F2C5D475D84721B25D6ADA3525A3BE2847789BCF25AA370D8AF33C32537E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ramnit sality adware backdoor banker defense_evasion discovery privilege_escalation spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

jaffacakes118_Virus.Win32.Nimnul.a.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

22 signatures

150 seconds

adware backdoor banker defense_evasion discovery ramnit sality privilege_escalation spyware stealer trojan upx worm

Behavioral task

behavioral2

Sample

jaffacakes118_Virus.Win32.Nimnul.a.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

backdoor discovery sality upx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/

Targets

- Target
  jaffacakes118_Virus.Win32.Nimnul.a.35018ba9753c4a3fb33b0
- Size 1.3MB
- SHA256 c207b62972589c9651a04eeb21b48d337f7c9bd9b942c6f61538faa18707b0f8
- MD5 a8070e526f135018ba9753c4a3fb33b0
- SHA1 965c0f5a72041118d38ae500f3ce547ce87915d9
- SHA512 91b05568840f3e6458f58db89f06dee61e8ed53eccf28b914c8eed6381e1abaf7ccbbd0097f870bc74522c3f1025b5a75084756f68e4c603336e203dd3c00ff8
- SSDEEP 12288:FqOPajQUXXP8QvLWFx6Mo5rippDC7ee1hpls4Ey+rzk7zYdBNn:FnajQEPnvg6PhWDC750vk7Cp
- TLSH
  T153555C40F2C5D475D84721B25D6ADA3525A3BE2847789BCF25AA370D8AF33C32537E0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware backdoor banker defense_evasion discovery ramnit sality privilege_escalation spyware stealer trojan upx worm
- Family: Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Family: Sality
  Sality is backdoor written in C++, first discovered in 2003.
  backdoor sality
- Modifies firewall policy service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Process Injection

Process Hollowing

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Process Injection

Process Hollowing

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

adwarebackdoorbankerdefense_evasiondiscoveryramnitsalityprivilege_escalationspywarestealertrojanupxworm

behavioral2

backdoordiscoverysalityupx

© 2018-2026

Terms | Privacy