MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Worm.Ramnit

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA3-384 hash:	8acba7ab6e00ac349105e4cd8fbfcad900147f9a75c45da61995bdface6d84950f6938f55f205681c4f1340f27fafd53
SHA1 hash:	99ee31cd4b0d6a4b62779da36e0eeecdd80589fc
MD5 hash:	56b2c3810dba2e939a8bb9fa36d3cf96
humanhash:	fruit-white-undress-dakota
File name:	qYyARs.bin
Download:	download sample
Signature	Worm.Ramnit Create hunting rule
File size:	15'872 bytes
First seen:	2021-08-13 08:35:34 UTC
Last seen:	2024-09-24 08:59:34 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	aa631f25c4bbd544554d9285d2f8bd38 (2 x Worm.Ramnit, 1 x Bdaejec)
ssdeep	384:7XZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:1QGPL4vzZq2o9W7GsxBbPr
Threatray	1'676 similar samples on MalwareBazaar
TLSH	T10B62BFB34EC098FFC4CD353340823687CB7B4670DABA617F826288372895E19AC55595
Reporter	milannshrestga
Tags:	backdoor exe Worm.Ramnit

Intelligence

File Origin

# of uploads :

# of downloads :

482

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

new ency.exe

Verdict:

Malicious activity

Analysis date:

2021-08-11 15:10:46 UTC

Tags:

trojan

Link:

https://app.any.run/tasks/6885cb00-4932-4fe5-8bef-6e76964a1202

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/178938/

Detection(s):

PUA.Win.Packer.Asprotect-3

Win.Trojan.Downloader-64720

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Changing an executable file

Creating a window

Modifying an executable file

Connection attempt to an infection source

Sending an HTTP GET request to an infection source

Creating a file in the %temp% directory

Query of malicious DNS domain

Infecting executable files

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/51a000df-39c2-4911-8a4c-17a3c17c3dee

Result

Threat name:

Unknown

Detection:

malicious

Classification:

spre.troj

Score:

66 / 100

Link:

https://www.joesandbox.com/analysis/832250

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Infects executable files (exe, dll, sys, html)

Machine Learning detection for sample

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Uses known network protocols on non-standard ports

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07/

Threat name:

Win32.Trojan.Skeeyah

Status:

Malicious

First seen:

2013-12-03 14:08:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 31 (100.00%)

Threat level:

5/5

Verdict:

unknown

Worm.Ramnit

1cedbd986cccb5d7ab511f7b4ddcf37c4e7f91f7c29b247a1da7e2539d01e5d3

Worm.Ramnit

27c75effad87490e00ec7a531292f4d4f0b02f63027fd44d1b977ba278d64e40

Worm.Ramnit

28cd19a6d585c291606a35b7247ec40b698810785c636058c7e2a52388fe02c0

Worm.Ramnit

5671e3f1a749fc51b1916e411cc232edf92008ad520d1b3adbd71c31e8dc3f15

Worm.Ramnit

8c16cdfaab0988019d1aabfe3382e1c298db3f26068eff62a83f9d1e93a65a1f

Worm.Ramnit

9cc3fad60f671aa64afaad40e7988c75e23df8e0b896976cdaeb050f42f7fdea

Worm.Ramnit

e3f451abe1844f672f5c57118e5ac0d820f8cf8e912d2cb51c05cb6343cdee15

Worm.Ramnit

f4a0df4b5eb072790d33c4207f4b273033a0b6b3b5335f0e8d09d8b32cb36157

Worm.Ramnit

fd22fefc5f2b5d29afaf068ba347b6630fe926898a2613fae52486bba53ece55

Worm.Ramnit

+ 1'666 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

aspackv2

Link:

https://tria.ge/reports/210813-xxqanrmvda/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Deletes itself

Unpacked files

SH256 hash:

1bb70910ead9ee353bd0801550ab5cc2e1bd95defaa69106aba7c003e93cd8e6

MD5 hash:

9fc6da9c0d2e1024e1f2eff891bf3ae1

SHA1 hash:

34ece797e18cf4a7ccf42ab30309bdc681ba2180

Detections:

win_unidentified_045_g0

win_unidentified_045_auto

Link:

https://www.unpac.me/results/2b501bac-8e49-4e11-ba52-f1a46d1a05d2/

SH256 hash:

4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

MD5 hash:

56b2c3810dba2e939a8bb9fa36d3cf96

SHA1 hash:

99ee31cd4b0d6a4b62779da36e0eeecdd80589fc

Link:

https://www.unpac.me/results/2b501bac-8e49-4e11-ba52-f1a46d1a05d2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.