MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Ramnit


Vendor detections: 14


Intelligence 14 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
SHA3-384 hash: 6c1f2516b672de076b5fef14da37f12258d839b1e761f78c763a8e67ac8dd06e10791bb7d2e48b50e9d70ff0474267f7
SHA1 hash: 77f57620487789d75cb797a85cbed0aa591cd37b
MD5 hash: a59ff905db489f204d7f8a83c2e866e2
humanhash: winter-idaho-monkey-pennsylvania
File name:E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe
Download: download sample
Signature Worm.Ramnit
Create hunting rule
File size:278'528 bytes
First seen:2024-07-24 22:29:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2b0cb1de227ee27eff54e94dd3b1cea8 (4 x RedLineStealer, 1 x Smoke Loader, 1 x Stop)
ssdeep 3072:ie72HycHbUE/GnJ1gJMBkTyKnEgopUTE79zNmz5l7IggIYRh8+U6bQfPQRIJBoaG:Kb/Agq3KnEg8YEFeIyYRh8d6GQuJBos
TLSH T1BF449E10BB90C035F1B752F44E7A83ADB93E7AB15B64A0CB22D55AEB16356E0EC31317
TrID 29.5% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
21.3% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
16.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
8.4% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
6.7% (.SCR) Windows screen saver (13097/50/3)
File icon (PE):PE icon
dhash icon badacabecee6baa6 (95 x Stop, 87 x RedLineStealer, 62 x Smoke Loader)
Reporter Anonymous
Tags:exe Worm.Ramnit


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
1
# of downloads :
322
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.Asprotect-3
Create hunting rule

Win.Virus.Wapomi-9802127-0
Create hunting rule

Win.Packed.Crypterx-9954995-0
Create hunting rule

Win.Malware.Wapomi-10020301-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a18031ae21d7902eafd1fd
Tags:
Execution Generic Network Static Stealth
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a process from a recently created file
Changing an executable file
Creating a window
Connection attempt to an infection source
Sending an HTTP GET request to an infection source
Unauthorized injection to a recently created process
Restart of the analyzed sample
Modifying an executable file
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Query of malicious DNS domain
Infecting executable files
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/445ef4cc-0347-4c1f-9a45-401b07d0d7da
Result
Threat name:
Bdaejec, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1480884
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
PE file contains section with special chars
PE file has a writeable .text section
Switches to a custom stack to bypass stack traces
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Yara detected Bdaejec
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1480884 Sample: E6D881EA9A11D23E31737469C38... Startdate: 25/07/2024 Architecture: WINDOWS Score: 100 38 host-data-coin-11.com 2->38 40 ddos.dnsnb8.net 2->40 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 Antivirus detection for URL or domain 2->50 52 11 other signatures 2->52 8 E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe 1 2->8         started        signatures3 process4 file5 36 C:\Users\user\AppData\Local\Temp\pNDEih.exe, PE32 8->36 dropped 62 Detected unpacking (changes PE section rights) 8->62 64 Contains functionality to inject code into remote processes 8->64 66 Injects a PE file into a foreign processes 8->66 68 Switches to a custom stack to bypass stack traces 8->68 12 E6D881EA9A11D23E31737469C38C5C74DE54ADC680A662D877C6CAB46E3A34AB.exe 8->12         started        15 pNDEih.exe 16 8->15         started        signatures6 process7 dnsIp8 70 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 12->70 72 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 12->72 74 Maps a DLL or memory area into another process 12->74 84 2 other signatures 12->84 19 explorer.exe 37 3 12->19 injected 44 ddos.dnsnb8.net 44.221.84.105, 49710, 49711, 799 AMAZON-AESUS United States 15->44 26 C:\Program Files\7-Zip\Uninstall.exe, PE32 15->26 dropped 28 C:\Program Files (x86)\AutoIt3\...\SciTE.exe, PE32 15->28 dropped 30 C:\Program Files (x86)\AutoIt3\...\MyProg.exe, MS-DOS 15->30 dropped 76 Antivirus detection for dropped file 15->76 78 Detected unpacking (changes PE section rights) 15->78 80 Machine Learning detection for dropped file 15->80 82 Infects executable files (exe, dll, sys, html) 15->82 24 WerFault.exe 22 16 15->24         started        file9 signatures10 process11 dnsIp12 42 host-data-coin-11.com 188.40.141.211, 49720, 80 HETZNER-ASDE Germany 19->42 32 C:\Users\user\AppData\Roaming\eeisdvt, PE32 19->32 dropped 34 C:\Users\user\...\eeisdvt:Zone.Identifier, ASCII 19->34 dropped 54 System process connects to network (likely due to code injection or exploit) 19->54 56 Benign windows process drops PE files 19->56 58 Deletes itself after installation 19->58 60 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->60 file13 signatures14
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8/
Threat name:
Win32.Virus.Jadtre
Create hunting rule
Status:
Malicious
First seen:
2024-07-24 22:29:06 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=32ajs4zo4w3t6p5g2azkotufo3igmy74c2zmnwrhuncej7oo2hea._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader botnet:pub2 aspackv2 backdoor discovery trojan
Link:
https://tria.ge/reports/240724-2d749s1ckp/
Behaviour
Checks SCSI registry key(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
ASPack v2.12-2.42
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
SmokeLoader
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/6978e2d7-efb9-4ad7-8c98-8bc39ea10a5d
Unpacked files
SH256 hash:
196c516ea546fb935ac669681a74a4dc80da79d9088f464f6cc6f126ae934f4e
MD5 hash:
c36de8bc9668ec4eaafca4c349dca0d5
SHA1 hash:
ea2cadfada69b93ca3abeb8b2462c5c18891fabf
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/9869e2a2-eed5-4a47-80fb-fa9811c789bf/
Parent samples :
6b2d7c8bdedb901d80c89717c9889abf169c9059d8bb545af6ca1960660324ad
8928eed86ea55a63e3646bf8ca403b4b1e57702f73c1ecc8fa403b5700a304ef
18ad362dcae8df5827846223c09ceba7766e09733b685d4067ee39037daec452
da39948d95cdbce6e1ca9e0fdbb77080164a379f593e530b5732d3fc38df7bf8
7c74a8c41e24f69015185f78b8fbc177edcbe9d27099e904497b2310999f74cb
92ebb6be19502fe2573a9eac183bcc657b88ac5b0344285d9db409b0a3d88dab
af6fa095b427a0e95dd826696c2b92b0123e688e3c95f6d27825cc2928085d1b
de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
SH256 hash:
b4fd119925d045d82de659087547ff69dd09bb0ea31f0058a32512edd92e7df9
MD5 hash:
daeabafa0f783ebd0eed96bd4304a2f2
SHA1 hash:
d87e5fb99efe24ea522b079c8cb5d786a3d12c96
Detections:
win_unidentified_045_auto
Create hunting rule
win_unidentified_045_g0
Create hunting rule
Link:
https://www.unpac.me/results/9869e2a2-eed5-4a47-80fb-fa9811c789bf/
SH256 hash:
de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8
MD5 hash:
a59ff905db489f204d7f8a83c2e866e2
SHA1 hash:
77f57620487789d75cb797a85cbed0aa591cd37b
Link:
https://www.unpac.me/results/9869e2a2-eed5-4a47-80fb-fa9811c789bf/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Worm.Ramnit

Executable exe de8099732ee5b73f3fa6d032a74e8576d06663fc16b2c6da27a34444fdced1c8

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::SetProcessShutdownParameters
KERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::FindNextVolumeW
KERNEL32.dll::FindNextVolumeMountPointA
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::GetDriveTypeW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::AllocConsole
KERNEL32.dll::FillConsoleOutputCharacterA
KERNEL32.dll::FillConsoleOutputCharacterW
KERNEL32.dll::FlushConsoleInputBuffer
KERNEL32.dll::WriteConsoleInputW
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleOutputCharacterA
KERNEL32.dll::WriteConsoleA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileExW
KERNEL32.dll::CopyFileA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::MoveFileWithProgressA
KERNEL32.dll::MoveFileA

Comments