Overview

overview

10

Static

static

3

1cd45314e3...18.dll

windows7-x64

10

1cd45314e3...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cd45314e39179888b35ce832c7d98e4_JaffaCakes118

  • Size

    132KB

  • Sample

    240701-2x2rlavflf

  • MD5

    1cd45314e39179888b35ce832c7d98e4

  • SHA1

    a21d451a84324b59e31ca67f9649ecdc036ccde3

  • SHA256

    e8be479ff81c41cb17c6208a6dc3f9c166dd6a3e02dcb57814ec832759a62044

  • SHA512

    5e2d79bee3e5f05c48792bc4e27e8338666c2a9ee52acc79ae91a6232b641a347082d4e56de950c3bf798e19b4998039935b1831459049685d21f5aee17e80a8

  • SSDEEP

    3072:Qo6nwLqrSa4I+VCpy330wN6qb3MAxwgKa:V6uj0wRb37x1

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1cd45314e39179888b35ce832c7d98e4_JaffaCakes118

    • Size

      132KB

    • MD5

      1cd45314e39179888b35ce832c7d98e4

    • SHA1

      a21d451a84324b59e31ca67f9649ecdc036ccde3

    • SHA256

      e8be479ff81c41cb17c6208a6dc3f9c166dd6a3e02dcb57814ec832759a62044

    • SHA512

      5e2d79bee3e5f05c48792bc4e27e8338666c2a9ee52acc79ae91a6232b641a347082d4e56de950c3bf798e19b4998039935b1831459049685d21f5aee17e80a8

    • SSDEEP

      3072:Qo6nwLqrSa4I+VCpy330wN6qb3MAxwgKa:V6uj0wRb37x1

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks