ramnit | 2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247 | Triage

Submit
Reports

Overview

overview

Static

static

2b69d81b3a...47.exe

windows7-x64

2b69d81b3a...47.exe

windows10-2004-x64

Sharing

General

Target

2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247
Size

110KB
Sample

221029-nxq37sfber
MD5

520a927c4bb56a9dbb83dae44058aa17
SHA1

cdd202e6989bb759f2c5e65a55a03e8e78d65c87
SHA256

2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247
SHA512

f9e4e2929cd0b9ee07e4bdd16f214880f3c0353bb138b24b22aee28a5ca03229235bd5f4f6e8855e45dc6fa58b0c6f2447b479e68cf723a7d72b9733846e9e88
SSDEEP

1536:7H+J23DkKx2nubl5rY2BVmi7C5i50jBI8xP5M9cuiqhzxmtUVv3YfATbIcuHxM0E:bj3D3qub7rLfv5M1d2XhzxmtcPhRuHw

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Static task

static1

Behavioral task

behavioral1

Sample

2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247.exe

Resource

win7-20220901-en

ramnit banker evasion persistence spyware stealer trojan worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247.exe

Resource

win10v2004-20220812-en

ramnit banker evasion spyware stealer trojan worm

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247
- Size
  
  110KB
- MD5
  
  520a927c4bb56a9dbb83dae44058aa17
- SHA1
  
  cdd202e6989bb759f2c5e65a55a03e8e78d65c87
- SHA256
  
  2b69d81b3a584d7a500c36022e35274095e3344f8cfc0260f8156d9d4989e247
- SHA512
  
  f9e4e2929cd0b9ee07e4bdd16f214880f3c0353bb138b24b22aee28a5ca03229235bd5f4f6e8855e45dc6fa58b0c6f2447b479e68cf723a7d72b9733846e9e88
- SSDEEP
  
  1536:7H+J23DkKx2nubl5rY2BVmi7C5i50jBI8xP5M9cuiqhzxmtUVv3YfATbIcuHxM0E:bj3D3qub7rLfv5M1d2XhzxmtcPhRuHw
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerevasionspywarestealertrojanworm

© 2018-2025

Terms | Privacy