ramnit | 1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1ec2f1f9e9...31.dll

windows7-x64

1ec2f1f9e9...31.dll

windows10-2004-x64

Sharing

General

Target

1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31
Size

348KB
Sample

221106-1cfsysefcl
MD5

0e68fc1dc87ebe15ecd18a18256fea40
SHA1

ea6465e474d22d39b0362b1741dec5c7f76e6dbe
SHA256

1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31
SHA512

8e76fc709ce006c4925a07069e4d59b00d5709ba00bdb8a02ecbbbae0ec647473ffafc7cbe116d7179cb30903d76238974214f912a9d55f31c686c24bf3f6d58
SSDEEP

6144:D3png1PL0i+tZBDMT025JD+dc584xDlwfyfjKe6H0D5Y:DZngJLO3MT025JD+o8CCOn6H0D5

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31.dll

Resource

win7-20220812-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31.dll

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31
- Size
  
  348KB
- MD5
  
  0e68fc1dc87ebe15ecd18a18256fea40
- SHA1
  
  ea6465e474d22d39b0362b1741dec5c7f76e6dbe
- SHA256
  
  1ec2f1f9e9c444691b6ce3cf72a74027edae0fbec88c9bf9dfc3178e723fcb31
- SHA512
  
  8e76fc709ce006c4925a07069e4d59b00d5709ba00bdb8a02ecbbbae0ec647473ffafc7cbe116d7179cb30903d76238974214f912a9d55f31c686c24bf3f6d58
- SSDEEP
  
  6144:D3png1PL0i+tZBDMT025JD+dc584xDlwfyfjKe6H0D5Y:DZngJLO3MT025JD+o8CCOn6H0D5
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy