ramnit | 5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b | Triage

Submit
Reports

Overview

overview

Static

static

5394a1dcc1...3b.exe

windows7-x64

5394a1dcc1...3b.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b
Size

281KB
Sample

221106-y12n8acehl
MD5

09dc21e7212847cc62aab46b56b5ae60
SHA1

9fbd6c298813e2483de43a6c2d338e124e509be5
SHA256

5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b
SHA512

42b4d68cc02fea3d4a9b4e84c6de4d3f972551a59d3853f008ad4271587e08feb8cd1adf3bb11a717aca26daf1b257f4bc24514db21fbe48c7415f6be4d2c096
SSDEEP

3072:GVpYDooBHxzZdwq+tcg23nMrz6oyhjkZriqub44Ye5fqO981SWyiceXJWg/WIVNU:v9RzjYtcgSnM36MLmLXwOTQjX7/JPU

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b.exe

Resource

win7-20220812-en

ramnit banker discovery spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b.exe

Resource

win10v2004-20220812-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b
- Size
  
  281KB
- MD5
  
  09dc21e7212847cc62aab46b56b5ae60
- SHA1
  
  9fbd6c298813e2483de43a6c2d338e124e509be5
- SHA256
  
  5394a1dcc1ccd7e9c1b8fe4c010bd9c996f6c853a0f658aacb4a138df101903b
- SHA512
  
  42b4d68cc02fea3d4a9b4e84c6de4d3f972551a59d3853f008ad4271587e08feb8cd1adf3bb11a717aca26daf1b257f4bc24514db21fbe48c7415f6be4d2c096
- SSDEEP
  
  3072:GVpYDooBHxzZdwq+tcg23nMrz6oyhjkZriqub44Ye5fqO981SWyiceXJWg/WIVNU:v9RzjYtcgSnM36MLmLXwOTQjX7/JPU
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy