MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Ramnit


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed
SHA3-384 hash: fa0f8a7351148de4e7de0beab5cbcb55e717d748ba557bc4df545feddb549ce1c9df51dfc359e38c20301756e8b771e4
SHA1 hash: 94bfed80b2abd9bbe365cfb18ca519bdedefb442
MD5 hash: bab24f0e7184e137e6621e732e9da30a
humanhash: equal-cup-kitten-lion
File name:bab24f0e_by_Libranalysis
Download: download sample
Signature Ramnit
Create hunting rule
File size:359'833 bytes
First seen:2021-05-05 09:05:17 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash a9b4893dc16c287d9c4d9d0dde885f37 (1 x Ramnit)
ssdeep 6144:plYi4Ip8DqDFpgROrl811u5P78bbsBbc1to:sRE8DqDFQyacFgb4bYq
Threatray 1'123 similar samples on MalwareBazaar
TLSH 907446B9A00EB9A2C0DF853413D599E1D7BF6C9107B041B96A708D65C6508BBF32D2EF
Reporter Libranalysis
Tags:ramnit


Avatar
Libranalysis
Uploaded as part of the sample sharing project

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'157
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/150162/
Detection(s):
Win.Trojan.Ramnit-1849
Create hunting rule

Win.Trojan.Ramnit-1847
Create hunting rule

Win.Trojan.Agent-7825982-0
Create hunting rule

Win.Virus.Ramnit-9775603-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a file in the %temp% directory
Deleting a recently created file
Launching the default Windows debugger (dwwin.exe)
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
ramnit
Create hunting rule
Link:
https://mwdb.cert.pl/sample/734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed/
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 10:44:44 UTC
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
Ramnit
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
Ramnit
1bceb4e84115eabb8bf3df704b5cc014834ca08b126451ae95d60a968e66d666
Ramnit
2dc2cf646b7c31af83b7e91b3fabcb0c86cefea53aca57ce7e0d52aa943de13c
Ramnit
414d612f1134c580046095e37ead026b1c2fbfa31432e1ee662276286983fa24
Ramnit
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
Ramnit
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
Ramnit
9b8e02c9169932cb809300c4dff5afc240aba4d5a87264f0f7123314345c6248
Ramnit
9edbdfe197acf70216e52d558ff3c076be7b71c67beaa56f0fe06ef769db144e
Ramnit
f1da2af4d03374487f047533fcf04795dab48c3b862342c0219bab3e5dbb52c4
Ramnit
+ 1'113 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/210505-twspt2d5qn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Suspicious use of NtCreateProcessExOtherParentProcess
Unpacked files
SH256 hash:
15f7fb2edc9b34e0da2fc658df38d8aea52664f6be1510dba4636dc13f466f86
MD5 hash:
303f491b9fc879064b210cb0b865d178
SHA1 hash:
5cbdc35fb45bd3fb5ac62950ec22443a4179203c
Detections:
win_ramnit_g0
Create hunting rule
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/b6ff73f4-b7ab-412e-805d-dc4ea81753c6/
SH256 hash:
58d019722418d4a5a264508a7ade6acb6328950dbd9f54a7b5f45ad71fe14a94
MD5 hash:
97e9ba33f27ff173e4526b578f05e805
SHA1 hash:
be72106b213694253e5348e49a45cebd783e236d
Link:
https://www.unpac.me/results/b6ff73f4-b7ab-412e-805d-dc4ea81753c6/
SH256 hash:
3e399248b2a34a8c4d56f2bc218b005766e204faeab5f1dfa2b58648b757bdf6
MD5 hash:
109d5ee03607af911f44eb9db3e1bccc
SHA1 hash:
279c9250d61579482c68508da2f662f644f39c2c
Link:
https://www.unpac.me/results/b6ff73f4-b7ab-412e-805d-dc4ea81753c6/
SH256 hash:
734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed
MD5 hash:
bab24f0e7184e137e6621e732e9da30a
SHA1 hash:
94bfed80b2abd9bbe365cfb18ca519bdedefb442
Link:
https://www.unpac.me/results/b6ff73f4-b7ab-412e-805d-dc4ea81753c6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Ramnit
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/734098da5181ec0da88f41dbfb9711ee9001a2b86c1c9d15d3281cdcaddfdeed

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/150162/

Comments