ramnit | 9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6 | Triage

Submit
Reports

Overview

overview

Static

static

9d68ca5d77...a6.exe

windows7-x64

9d68ca5d77...a6.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6
Size

232KB
Sample

221030-c6dnpahca6
MD5

9296dfc71b2fde6be07220b43646fb5f
SHA1

af0901da8d4b370e1193305af0b68b49acdaff12
SHA256

9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6
SHA512

94a076e496b6b8a5a9ac41b8346c5c1691f0afe42e1ad38a229bcc2a9c07242da9f27e52c7f4bd4805759c3b74d15334d0fc24713710edaa938888b3ef3d40f4
SSDEEP

3072:+AGrHHi9ltddz5c29VHbWVIV/FJxB1z+2Zt5yJmk+DnNF8cEH:RGr8z5/PNRB1aUtnDc

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6.exe

Resource

win7-20220812-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6.exe

Resource

win10v2004-20220901-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6
- Size
  
  232KB
- MD5
  
  9296dfc71b2fde6be07220b43646fb5f
- SHA1
  
  af0901da8d4b370e1193305af0b68b49acdaff12
- SHA256
  
  9d68ca5d7762a8b486fb2abe86a5341734b46cc7df2666ea55bbb398d47bb3a6
- SHA512
  
  94a076e496b6b8a5a9ac41b8346c5c1691f0afe42e1ad38a229bcc2a9c07242da9f27e52c7f4bd4805759c3b74d15334d0fc24713710edaa938888b3ef3d40f4
- SSDEEP
  
  3072:+AGrHHi9ltddz5c29VHbWVIV/FJxB1z+2Zt5yJmk+DnNF8cEH:RGr8z5/PNRB1aUtnDc
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy