ramnit | 1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

1cfeed31a2...92.dll

windows7-x64

8

1cfeed31a2...92.dll

windows10-2004-x64

Sharing

General

Target

1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092
Size

408KB
Sample

221106-1cp2maefcr
MD5

073500ec69c090b55df028bb28bc24e0
SHA1

9654bb1883890b822767472ac54dc03791d6ac96
SHA256

1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092
SHA512

5065df48ff09066d53b05a2ee714e9572831b4287b96a28306953824bd13eb87c6a29eaeb324afe719b29b04eff864ef9e1c2c991f56a4e587c13fac7464fe09
SSDEEP

6144:N/u6A81l3T4/Db2TcwQGCbA2HiIasZsQeewQeeCQeesQeeKFQeefQeeytPUaYeza:I6A81u7QQGo9iILbtP6YLaYhCmc/Z/

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092.dll

Resource

win7-20220812-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092.dll

Resource

win10v2004-20220901-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092
- Size
  
  408KB
- MD5
  
  073500ec69c090b55df028bb28bc24e0
- SHA1
  
  9654bb1883890b822767472ac54dc03791d6ac96
- SHA256
  
  1cfeed31a29583193c9ae6477ce9f4e50b86614a9794833e37792989660a1092
- SHA512
  
  5065df48ff09066d53b05a2ee714e9572831b4287b96a28306953824bd13eb87c6a29eaeb324afe719b29b04eff864ef9e1c2c991f56a4e587c13fac7464fe09
- SSDEEP
  
  6144:N/u6A81l3T4/Db2TcwQGCbA2HiIasZsQeewQeeCQeesQeeKFQeefQeeytPUaYeza:I6A81u7QQGo9iILbtP6YLaYhCmc/Z/
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy