MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f71eb9c8a80ea511ade6a4ea951cd642c7046f3a97c7b965fdc732314bb3224. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Ramnit


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4f71eb9c8a80ea511ade6a4ea951cd642c7046f3a97c7b965fdc732314bb3224
SHA3-384 hash: 47820ba2814a417ef189c1503c652754ccab9aa6d4d864c6d14fa2d9edabc9d11edefbbb154f9492b838f76876f3f8c4
SHA1 hash: c8c8071eb3446381be63d55490175d46ddc49bed
MD5 hash: 5e24a1cbadfa2a3db36923b8616022e2
humanhash: wisconsin-pluto-speaker-jig
File name:b171526be6f383e359f760a89ddac1e0
Download: download sample
Signature Worm.Ramnit
Create hunting rule
File size:381'952 bytes
First seen:2020-11-17 15:31:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cf436b2d8382be2acb3225554d5da2ff (30 x Jadtre, 17 x Wapomi, 4 x Worm.Ramnit)
ssdeep 3072:uAIMEzJjHCXz33333333N33333333OqGMwqn5dFNijROw66ZwqEGCsi6ZCWYwMpJ:uARUHCXIe/FgOwpwgG64J7u
TLSH E984082B6F64D707DED0D878B4CCDB73D9E80F11529236D1A971E93E99F8084A8C907A
Reporter seifreed
Tags:Worm.Ramnit

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the Program Files subdirectories
Creating a window
Changing an executable file
Launching a process
DNS request
Searching for the window
Modifying an executable file
Creating a file
Running batch commands
Creating a process with a hidden window
Connection attempt to an infection source
Infecting executable files
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4f71eb9c8a80ea511ade6a4ea951cd642c7046f3a97c7b965fdc732314bb3224/
Threat name:
Win32.Worm.Ramnit
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 15:37:34 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j5y6xhekqdvfcgw6njhksuonmqwharxtvf6hxfs73rzsgff3gisa._file
Unpacked files
SH256 hash:
4f71eb9c8a80ea511ade6a4ea951cd642c7046f3a97c7b965fdc732314bb3224
MD5 hash:
5e24a1cbadfa2a3db36923b8616022e2
SHA1 hash:
c8c8071eb3446381be63d55490175d46ddc49bed
Link:
https://www.unpac.me/results/03c34e4b-ceaf-42a5-a913-d16af94c80cd/
SH256 hash:
d1b5e3e58f05ec1591d494cf103f4a4a71698364449f2243454474168b11731b
MD5 hash:
5eae8511a18fb85000bdc0a04eecc07a
SHA1 hash:
88939c6c909c5245bba137692485b72c10714228
Detections:
win_unidentified_045_g0
Create hunting rule
Link:
https://www.unpac.me/results/03c34e4b-ceaf-42a5-a913-d16af94c80cd/
SH256 hash:
6057d87753daee3c71eb8c0d3cb8582ea88d6e56f02864019db9fd7af3fb4a9f
MD5 hash:
651defc532f0e72be60621696aa97972
SHA1 hash:
43176a96322202fc8fd8901c213fde820d005871
Detections:
win_ramnit_g1
Create hunting rule
win_ramnit_auto
Create hunting rule
Link:
https://www.unpac.me/results/03c34e4b-ceaf-42a5-a913-d16af94c80cd/
Parent samples :
3aae149445e6ae7d5dff0a830abcd1bb26b868e4e7c8cf8bc625a9e46795d96b
4f71eb9c8a80ea511ade6a4ea951cd642c7046f3a97c7b965fdc732314bb3224
712902f16ad8e9570dc1e25dba5f4219f3fdd497d727f08dd98f1c6baa78335b
21077824b7eea56bdfe182de863fe599286c70fd067744faf6fa850da7342db3
3eabf4e909e889bfcb994a36d041ced30c30a377a6a0d6057eda4b8f35f4ca0e
1d448335a3b897166b49488a43f72689a054cd464ad5b5b148d57454d0515f50
680e418e349d611812a6afd357c39fa4fe3baf32cd95012f9b0632a364f2f349
bd5f19d54c0d5de713d609653e64116e07af8037a322f803850c9cb1e6a03c90
f158a9650580dcf9a875b153192a86e20798c7f01b4a458b668704661e2cc89c
b8e40ed3d1f01fd75f0f43d4784d92aaa9596f289f23c35969af1a4c1e149c30
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
4e707c27c365409032b8081092276d83498149589fa42c52271febbc5682bc81
0df97a0e5fe6fa55e4e8d20b0478a80dfb6d080bca66e630e9f80ed4838facee
06f2fef10fedbb774853c71cc9c923cd56d49d6165a6476fa7e5445550b0a6dc
81b64a354103b21b8d7f2bebb62923b5c2bc4f7f9cba5197fc24b5d869c032be
33b4058adaed65e17b07ee1c11af2c1a53e65dbd98f86cdfc72d841529160c14
aa7c68bbb7a270aede803fb6d767aaec5794724cb2711a34c15eac54cfd9a88f
d7ec3fcd80b3961e5bab97015c91c843803bb915c13a4a35dfb5e9bdf556c6d3
493c63489f594c10e1f5aace2dd833f3fddaac2800d3603498d2b4abe4bd7e0c
f09ec41136e8e5e5076ca495192d9326e5581c748148fa877412d466db26112d
33d3f697332b0fc4e09540cb9dc622ac0675fb8b2733554d4c0199307774ab52
973c7137d6a2921d75eb42cb09ef9270a60ca23f25457bb5803a604effd14eb4
93e0a3cbd07c8c1e99fea9e05a7a2bd7a312cf92d3b407be37db43774827ca09
876c5cea11bbbcbe4089a3d0e8f95244cf855d3668e9bf06a97d8e20c1ff237c
b5aa1fa3949badd59b3c1a6f5a838c8eadf639c4199b7238179f0de512383217
60292e6be9d0d5e5f82a3382e4b69fcd19362b4c30a1829787dfc6ea5462a117
87c160843bc0bdcd754a151c288f899763494385830016c299245f1fe9354b54
daa4efd6ea62d68ce47d73ee57d12cacb07d84ed87e7b4d680c20a715e29e519
ab41d83fb3c5aedecd6fbb3c54ce1c3a58d73d9969fc9c76d01c1c3f2b8c8cc2
f2574f6588e32a3d97988edb359a4f0a9a2df8f36caf8a0e2597d46bb2551985
482991b76849008ad700cf7e29ddd2b3d00d7d40d69377650154dca3adfde791
be4f04a6cb1df55610f461e3e05d81daebe75cbab021746e0cbf6b05389ff02b
ceeed21fc6b040b57c17d0b94c3af9597abde599a37192f40730656e48633b51
d0265e42d4f24fa518f631540cd3e29d9f1086448400de348c300c63bf6aa35f
8a9e221015ab7127c650f6fe81ef3e062ae7ebe00f88ba04717189099862c7d7
d0df8fac2089608a6b5dee7132981e88ab3b98178aff1d3fe7e003d388541e24
ee9378542050d13b1028b443f214d363dac7d11c1229e7e9054efde251d3e36b
c1ebd4c1595fa80d6521320a9500d22b55693bd7ce20af58492a1018b8ccf18e
90dd057ac1bdec6b27174681b857af28e2ddd05f84b7536eecd28cf6cc1a1189
cb9e615dcaf44187ad82f13ee4b711c38696c33e0fc25aa44309937bd571811f
08e00ccaa704c210e5841227e0db6b5c911ad675f3eaf48f5a629877c0ac3de1
250f05b7b22f886df69550d87c9f0139c0ddfb7dc85b6c6c7e12d1ae3b71d1e7
990357fe141b7e0ef376eb3d71279a6d160f8bbbd3e6d25e269c34af50e6ef04
4bb178da0a560d36af39e243dda93fe45446907a00009210abd6ba1a036a600c
2c3804853d63043067a602c9b5271831d7c8b7b9bc91e39a061e28135588b6b3
SH256 hash:
876c5cea11bbbcbe4089a3d0e8f95244cf855d3668e9bf06a97d8e20c1ff237c
MD5 hash:
44e92c4b5f440b756f8fb0c9eeb460b2
SHA1 hash:
ed5bf6e6e4f2b71ba1e0f73381ee64155f9722c2
Link:
https://www.unpac.me/results/03c34e4b-ceaf-42a5-a913-d16af94c80cd/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments