Overview

overview

10

Static

static

3

1747bd6ec5...18.exe

windows7-x64

10

1747bd6ec5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118

  • Size

    95KB

  • Sample

    240627-ydfhgaxblh

  • MD5

    1747bd6ec5a7f0885dd83f81bf5e217d

  • SHA1

    561ffdedb67a0099b1cf234cf0eb8afaacf49a04

  • SHA256

    de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838

  • SHA512

    461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4

  • SSDEEP

    768:W06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:0R0vxn3Pc0LCH9MtbvabUDzJYWu3B

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1747bd6ec5a7f0885dd83f81bf5e217d_JaffaCakes118

    • Size

      95KB

    • MD5

      1747bd6ec5a7f0885dd83f81bf5e217d

    • SHA1

      561ffdedb67a0099b1cf234cf0eb8afaacf49a04

    • SHA256

      de5f9b20738114231dac80a55bc3e0f2f1e2e7d27a84cf98f171aff34de05838

    • SHA512

      461a20c9c23a54cbb22c65b975ca420aa0d2033d451ed494f6dc25e6969059ba9fda6523b4a78bff78bee137f27b3af84621d0f3b45c15f2033243dfea6368d4

    • SSDEEP

      768:W06R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:0R0vxn3Pc0LCH9MtbvabUDzJYWu3B

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks