MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Ramnit


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a
SHA3-384 hash: 141cc9368367a31840b79f1c5530873bc1d8f89993e0f80cfc80a5fa184381adcd57034bc916cc92925c377353b3f702
SHA1 hash: 59fc22e854e3b82dd1118e4abbd91c9ec3fe5b6a
MD5 hash: e7505ce1718c2640bbccb6be57040292
humanhash: violet-eight-fillet-utah
File name:LisectAVT_2403002B_98.exe
Download: download sample
Signature Worm.Ramnit
Create hunting rule
File size:374'784 bytes
First seen:2024-07-25 01:40:05 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 632c0082677b53886d85a93e74f074ee (2 x RedLineStealer, 1 x LummaStealer, 1 x Glupteba)
ssdeep 6144:AsA/8ebE8vRBkZhNfJCQwrx+tAGWKDrYq:AD/8ebE0RBWJ2
TLSH T1DA84AE53B2E17C60F57687324D2D86E8262EF9F34E267B6B23585A0F08B11E1C673752
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon c810ccc8d0c4e030 (1 x Worm.Ramnit)
Reporter Anonymous
Tags:exe Worm.Ramnit


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Win.Malware.Wapomi-10020301-0
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing an executable file
Creating a window
Searching for synchronization primitives
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Launching the default Windows debugger (dwwin.exe)
Modifying an executable file
DNS request
Connection attempt
Sending an HTTP GET request
Query of malicious DNS domain
Infecting executable files
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
fingerprint lolbin shell32
Link:
https://www.filescan.io/uploads/66a1ad31bd793c18bfb672f9/reports/f07e8710-69b7-459b-8cb3-bf59e6c1d23d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Bdaejec, GCleaner, Nymaim
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1481564
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2024-07-25 01:41:06 UTC
File Type:
PE (Exe)
Extracted files:
25
AV detection:
36 of 38 (94.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ujud5n3stblbbrfvzkwjjiknksvadcqyjgtz2dwxcmxio63kt4fa._file
Verdict:
malicious
Result
Malware family:
gcleaner
Create hunting rule
Score:
  10/10
Tags:
family:gcleaner aspackv2 discovery loader
Link:
https://tria.ge/reports/240725-b3lz8atdle/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
Drops file in Program Files directory
ASPack v2.12-2.42
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
GCleaner
Malware Config
C2 Extraction:
185.172.128.90
5.42.64.3
5.42.65.115
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/747b359a-9f22-4b78-a93a-93cec3304359
Unpacked files
SH256 hash:
07d8bd00c483ea18b026a42346905d245b84dcfbfe6290b215222f3979a8886a
MD5 hash:
638075fdc31f52e28ea21eb83157f9b4
SHA1 hash:
3feffd836aea527b25336c8fdd2101bd5e24b5f0
Detections:
GCleaner
Create hunting rule
win_gcleaner_auto
Create hunting rule
Link:
https://www.unpac.me/results/815e6379-8127-472a-b6dd-80b02a0cb819/
Parent samples :
b9dd5b5112232c3266b326271d24c2d8af866a386c34fb2d4cd3c414f995b587
f1a83ca51de663f90eddcee2480847538f36d6151306d4c31f9d5e8baf709a9b
508e67f9f8ecec59538cd61fc6aaf0c25b4194d6dbd8b830f7b5bb2b8adf5ae9
9314d40f064aed182d1b0910dcc17d215a7bcdfe7fa356202c0f84556fbce9f1
6a345ac4726c427e82a2121ae310adce203aa39c1c3d7ce48f5670cb833345a8
2f4e51dacadfa0f435684aea798967d63adea5f31e997cde89eed60ba4e9e364
22e81782e13556ff0e50f878303b5e66953379dee68d0f5314762585a59781a3
00efc6f7f740e5423da1a6817a21f5cdcfaa6366e57413cc55dc255f81962d82
4af89e5a1cfa894ce90b1a5acb94abd36e90339e92c137d2f77d59c2e1efdb6f
a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a
SH256 hash:
e82dafda543ec240acbbb6c6d8541c07ff3f70f08039668c5a7d93ad3d83c1eb
MD5 hash:
daf12e66e73c05c44314f51ee4bc9fcf
SHA1 hash:
1c3ee98b40e163ae95417fda1e270dba5994f5aa
Detections:
win_unidentified_045_auto
Create hunting rule
win_unidentified_045_g0
Create hunting rule
Link:
https://www.unpac.me/results/815e6379-8127-472a-b6dd-80b02a0cb819/
SH256 hash:
a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a
MD5 hash:
e7505ce1718c2640bbccb6be57040292
SHA1 hash:
59fc22e854e3b82dd1118e4abbd91c9ec3fe5b6a
Link:
https://www.unpac.me/results/815e6379-8127-472a-b6dd-80b02a0cb819/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:EXE_Stealer_StealC_Feb2024
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Worm.Ramnit

Executable exe a2683eb772985610c4b5caac94a14d54aa018a1849a79d0ed7132e877b6a9f0a

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindFirstVolumeMountPointA
KERNEL32.dll::GetFirmwareEnvironmentVariableW
KERNEL32.dll::SetSystemPowerState
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryExW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleA
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::PeekConsoleInputA
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::SetConsoleTextAttribute
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileW
KERNEL32.dll::GetWindowsDirectoryA
KERNEL32.dll::RemoveDirectoryA
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::QueryDosDeviceA

Comments