Overview

overview

10

Static

static

3

1f4abdd016...18.dll

windows7-x64

10

1f4abdd016...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1f4abdd0162d61af5de529a060cb169f_JaffaCakes118

  • Size

    4.9MB

  • Sample

    240702-per38awbpq

  • MD5

    1f4abdd0162d61af5de529a060cb169f

  • SHA1

    03a8918e8d1960afa10f519874876503ac62bba8

  • SHA256

    de91f29f2914e7d36811857d09009d53cb6470ed9da6b4bf20cc3ac87296f5ee

  • SHA512

    24e59cbf91de206ec773461c799b981cf50fc6bd7abdc17052f829acdd97bf9c734ebe7afe8be0199222be47f918d8fbb59b37ca99f16eb8a4992142da14fa1c

  • SSDEEP

    98304:naTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukP:naTiZ7qfRmp3QZ6/+9Fu/v0AmWhP

Score
10/10
ramnitbankerpersistencespywarestealertrojanupxworm

Malware Config

Targets

    • Target

      1f4abdd0162d61af5de529a060cb169f_JaffaCakes118

    • Size

      4.9MB

    • MD5

      1f4abdd0162d61af5de529a060cb169f

    • SHA1

      03a8918e8d1960afa10f519874876503ac62bba8

    • SHA256

      de91f29f2914e7d36811857d09009d53cb6470ed9da6b4bf20cc3ac87296f5ee

    • SHA512

      24e59cbf91de206ec773461c799b981cf50fc6bd7abdc17052f829acdd97bf9c734ebe7afe8be0199222be47f918d8fbb59b37ca99f16eb8a4992142da14fa1c

    • SSDEEP

      98304:naTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukP:naTiZ7qfRmp3QZ6/+9Fu/v0AmWhP

    Score
    10/10
    ramnitbankerpersistencespywarestealertrojanupxworm

    • Modifies WinLogon for persistence

      persistence

    • Ramnit

      Ramnit is a versatile family that holds viruses, worms, and Trojans.

      trojanspywarestealerwormbankerramnit

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks