Overview

overview

10

Static

static

3

1b492660af...18.exe

windows7-x64

10

1b492660af...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1b492660af66d3abec3e0d4ea1eae510_JaffaCakes118

  • Size

    92KB

  • Sample

    240701-pkcwgs1fle

  • MD5

    1b492660af66d3abec3e0d4ea1eae510

  • SHA1

    1faefb5843f578aa742456329cfcb38bfc0ca3ac

  • SHA256

    a2f381584d058302fd4906ece8624dff8a9f8c00ecee6e84ca70efad80be9381

  • SHA512

    6d0f076a9a04bd310647b0457dd41e590e6c4b71aa9ea3144722e12dd0cd37d87501de58d1896644aff634554931d2a3412f0f776fefeecee84e8d9b4a5a78da

  • SSDEEP

    1536:1VZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApET:lnxwgxgfR/DVG7wBpET

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1b492660af66d3abec3e0d4ea1eae510_JaffaCakes118

    • Size

      92KB

    • MD5

      1b492660af66d3abec3e0d4ea1eae510

    • SHA1

      1faefb5843f578aa742456329cfcb38bfc0ca3ac

    • SHA256

      a2f381584d058302fd4906ece8624dff8a9f8c00ecee6e84ca70efad80be9381

    • SHA512

      6d0f076a9a04bd310647b0457dd41e590e6c4b71aa9ea3144722e12dd0cd37d87501de58d1896644aff634554931d2a3412f0f776fefeecee84e8d9b4a5a78da

    • SSDEEP

      1536:1VZnxm6MG9xgfrvEaoiT/GyphjXDYjKwttoswRmhApET:lnxwgxgfR/DVG7wBpET

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks