Overview

overview

10

Static

static

3

1abef37998...18.exe

windows7-x64

10

1abef37998...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1abef379982d89a2044370a9f2358429_JaffaCakes118

  • Size

    147KB

  • Sample

    240701-la5lzaxajr

  • MD5

    1abef379982d89a2044370a9f2358429

  • SHA1

    ba534aa1ff9a846fab2fc91fa090984fd29716c1

  • SHA256

    dabcdb88641c8d7deb42d7a55a0b8cf344ae4187b5409e885655d00b7b98ac18

  • SHA512

    c4d7b3bb16def6cfd684ca8426249888783207477598ef61ff935b695051f1e0f1f68f2e906de2e3ba0a1c4647918a635ff24ab01e70ad9d6075de713c8e9a5b

  • SSDEEP

    3072:3fyc8EOZ4QE2TVFJ1dvqjonnQ0BnBRf9W0PF109xFpp8:vf8ZDE2f9q0BfNQF

Score
10/10
ramnitbankerspywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1abef379982d89a2044370a9f2358429_JaffaCakes118

    • Size

      147KB

    • MD5

      1abef379982d89a2044370a9f2358429

    • SHA1

      ba534aa1ff9a846fab2fc91fa090984fd29716c1

    • SHA256

      dabcdb88641c8d7deb42d7a55a0b8cf344ae4187b5409e885655d00b7b98ac18

    • SHA512

      c4d7b3bb16def6cfd684ca8426249888783207477598ef61ff935b695051f1e0f1f68f2e906de2e3ba0a1c4647918a635ff24ab01e70ad9d6075de713c8e9a5b

    • SSDEEP

      3072:3fyc8EOZ4QE2TVFJ1dvqjonnQ0BnBRf9W0PF109xFpp8:vf8ZDE2f9q0BfNQF

    Score
    10/10
    ramnitbankerspywarestealertrojanupxworm

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

1
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks