Overview

overview

10

Static

static

3

1ab1804575...18.exe

windows7-x64

10

1ab1804575...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ab1804575d60caf806435699834ee6b_JaffaCakes118

  • Size

    99KB

  • Sample

    240701-ky4h5ssfje

  • MD5

    1ab1804575d60caf806435699834ee6b

  • SHA1

    4e7ee6602b428dd52fc21f9610860d88c951dc56

  • SHA256

    6c5692e30c0e147626a051cc055157ccd20edeaa00204dac69624bceafdf4069

  • SHA512

    542516ad6a1e3bed61bc5e8b1f59bf81144154270f8212b44b58a80a76569eab019688ab45cbfe765147ca1dd07ae941d9c1b30838251ca7abaf663c10c61079

  • SSDEEP

    768:706R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:JR0vxn3Pc0LCH9MtbvabUDzJYWu3B

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1ab1804575d60caf806435699834ee6b_JaffaCakes118

    • Size

      99KB

    • MD5

      1ab1804575d60caf806435699834ee6b

    • SHA1

      4e7ee6602b428dd52fc21f9610860d88c951dc56

    • SHA256

      6c5692e30c0e147626a051cc055157ccd20edeaa00204dac69624bceafdf4069

    • SHA512

      542516ad6a1e3bed61bc5e8b1f59bf81144154270f8212b44b58a80a76569eab019688ab45cbfe765147ca1dd07ae941d9c1b30838251ca7abaf663c10c61079

    • SSDEEP

      768:706R0UKzOgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9Y:JR0vxn3Pc0LCH9MtbvabUDzJYWu3B

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks