ramnit | 7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e | Triage

Submit
Reports

Overview

overview

Static

static

7c677d474e...7e.exe

windows7-x64

7c677d474e...7e.exe

windows10-2004-x64

8

Sharing

General

Target

7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e
Size

103KB
Sample

221029-eqexxsbdhk
MD5

5dd9e47c20c4ab4f9bcf97fdac6092ae
SHA1

171cebaf06b2c8a198ec5084c347b97d690b021f
SHA256

7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e
SHA512

076459a471715e75cc7112e733b383dd2d46be9f48bdce088051161f07eaa45919bc28936908506c43bdd45a2ba56886ee420784c2c4766dc57abd8bc7909454
SSDEEP

1536:Ocm1t4MluQqXc4vdcHcpTJioZJcUOzyKhcxVXJ4yqEpOEY4ExsKpkpYnCLt:5s4vy4T1uX1QTNExsGCjJ

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e.exe

Resource

win7-20220812-en

ramnit banker evasion persistence spyware stealer trojan upx worm

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e.exe

Resource

win10v2004-20220812-en

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e
- Size
  
  103KB
- MD5
  
  5dd9e47c20c4ab4f9bcf97fdac6092ae
- SHA1
  
  171cebaf06b2c8a198ec5084c347b97d690b021f
- SHA256
  
  7c677d474e848032460b3928bc3421a3a502ecbe49245a66be33fed9ac5fbf7e
- SHA512
  
  076459a471715e75cc7112e733b383dd2d46be9f48bdce088051161f07eaa45919bc28936908506c43bdd45a2ba56886ee420784c2c4766dc57abd8bc7909454
- SSDEEP
  
  1536:Ocm1t4MluQqXc4vdcHcpTJioZJcUOzyKhcxVXJ4yqEpOEY4ExsKpkpYnCLt:5s4vy4T1uX1QTNExsGCjJ
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanupxworm

behavioral2

© 2018-2025

Terms | Privacy