ramnit | 199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

199a8d08c1...78.dll

windows7-x64

199a8d08c1...78.dll

windows10-2004-x64

Sharing

General

Target

199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78
Size

750KB
Sample

221030-dbvjdshea8
MD5

a2c658faafefc73827e31ee9f0d02a00
SHA1

8343119d82f68fa8c91e454e89cbfe685c58b9bd
SHA256

199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78
SHA512

904b0a7bdaf9aae0a7b0628ebb322bb4af522183be9712738099320d5cd078a728c199f1225ba7e4d340d4ea392b23fc03261b6198527b3e85b7e56b33c0dfd5
SSDEEP

12288:nzb9rMfc+CKUQyUmjtc4euuzPrs9pGp8hunWoopooK9kwPMqMH:nzb1MlCKUQyUmjtczu6Prs9pgWoopoob

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78.dll

Resource

win7-20220812-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78.dll

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78
- Size
  
  750KB
- MD5
  
  a2c658faafefc73827e31ee9f0d02a00
- SHA1
  
  8343119d82f68fa8c91e454e89cbfe685c58b9bd
- SHA256
  
  199a8d08c1494d025330e8ef939fd6d4f183fd8395b5ce9d0d23583bbf22dc78
- SHA512
  
  904b0a7bdaf9aae0a7b0628ebb322bb4af522183be9712738099320d5cd078a728c199f1225ba7e4d340d4ea392b23fc03261b6198527b3e85b7e56b33c0dfd5
- SSDEEP
  
  12288:nzb9rMfc+CKUQyUmjtc4euuzPrs9pGp8hunWoopooK9kwPMqMH:nzb1MlCKUQyUmjtczu6Prs9pgWoopoob
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy