ramnit | e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

e5e6b02ccf...07.dll

windows7-x64

e5e6b02ccf...07.dll

windows10-2004-x64

Sharing

General

Target

e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807
Size

529KB
Sample

221030-xxbg7agbek
MD5

828efd221790e2a87cea95207e731ea9
SHA1

811810bc5fa0ed61fc81edf131b7931bbd72c746
SHA256

e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807
SHA512

7fdc73e60b9bdcbda99d6c314d83e69ff4c09d2d92c530a7bb326e4aa7e912a06533a688454cc27bd5500305b31a137aefb0604228c0f12239c05348a8c8206f
SSDEEP

12288:RzA5lZhy6RpB/6eXMVVLrkwTzCunpKI13YEqWpKHEFfo3A:RzA5HhRPSeX2VHkuzRnpz1ouKHxA

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807.dll

Resource

win7-20220812-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807.dll

Resource

win10v2004-20220901-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807
- Size
  
  529KB
- MD5
  
  828efd221790e2a87cea95207e731ea9
- SHA1
  
  811810bc5fa0ed61fc81edf131b7931bbd72c746
- SHA256
  
  e5e6b02ccf83b2edc9e1894a717b2c9114d2fd984617867b59d10922ec908807
- SHA512
  
  7fdc73e60b9bdcbda99d6c314d83e69ff4c09d2d92c530a7bb326e4aa7e912a06533a688454cc27bd5500305b31a137aefb0604228c0f12239c05348a8c8206f
- SSDEEP
  
  12288:RzA5lZhy6RpB/6eXMVVLrkwTzCunpKI13YEqWpKHEFfo3A:RzA5HhRPSeX2VHkuzRnpz1ouKHxA
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy