Overview

overview

10

Static

static

3

154dd7d963...18.exe

windows7-x64

10

154dd7d963...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    154dd7d9638995072c2c78ab478a3043_JaffaCakes118

  • Size

    166KB

  • Sample

    240627-j9bf3atcpl

  • MD5

    154dd7d9638995072c2c78ab478a3043

  • SHA1

    339ecc8ec888de71c6f76913e8cc97a0dcbc0060

  • SHA256

    9fcc3b77d2085e60800e7f6e61e87d494c5b9bab5903135230f21b24df4aa67d

  • SHA512

    663349206cbef3ee2b8f0a29fb89db78bf9cc8a319c910bd73e993b2a7cc21924402c156096b15467017aabb7f315e5f3adf75d6bba1cd7b60adafd4e5bb4d2b

  • SSDEEP

    1536:8NpbWTono2PF9yJH9KBjH7ZoSQoL+Qz6AkMK6TNXkZXdrBVPjlVRuwz24+g:ldKFOoL16AkMK6BXEtrB9jlP5Yg

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      154dd7d9638995072c2c78ab478a3043_JaffaCakes118

    • Size

      166KB

    • MD5

      154dd7d9638995072c2c78ab478a3043

    • SHA1

      339ecc8ec888de71c6f76913e8cc97a0dcbc0060

    • SHA256

      9fcc3b77d2085e60800e7f6e61e87d494c5b9bab5903135230f21b24df4aa67d

    • SHA512

      663349206cbef3ee2b8f0a29fb89db78bf9cc8a319c910bd73e993b2a7cc21924402c156096b15467017aabb7f315e5f3adf75d6bba1cd7b60adafd4e5bb4d2b

    • SSDEEP

      1536:8NpbWTono2PF9yJH9KBjH7ZoSQoL+Qz6AkMK6TNXkZXdrBVPjlVRuwz24+g:ldKFOoL16AkMK6BXEtrB9jlP5Yg

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks