ramnit | 632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425 | Triage

Submit
Reports

Overview

overview

Static

static

632472d50f...25.exe

windows7-x64

632472d50f...25.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425
Size

115KB
Sample

221107-hws9aafgap
MD5

0c49fba2a49d2d4e81749d11225a1f16
SHA1

ed497781360c9098ada3d84cd7c23bab2275c277
SHA256

632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425
SHA512

0392ab574a082958aedb543edff4b4bc56b089266d95b311b6be8f881d013417281d1bde45e928bfd38b4d9497ff801eba90857471e253313e1817b5167bdbae
SSDEEP

768:o06R0UEgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:mR0In3Pc0LCH9MtbvabUDzJYWu3B

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425.exe

Resource

win7-20220812-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425.exe

Resource

win10v2004-20220901-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425
- Size
  
  115KB
- MD5
  
  0c49fba2a49d2d4e81749d11225a1f16
- SHA1
  
  ed497781360c9098ada3d84cd7c23bab2275c277
- SHA256
  
  632472d50f0b26445e691dc7986723d246111e5ec7381c6ff12fc38a9a7a6425
- SHA512
  
  0392ab574a082958aedb543edff4b4bc56b089266d95b311b6be8f881d013417281d1bde45e928bfd38b4d9497ff801eba90857471e253313e1817b5167bdbae
- SSDEEP
  
  768:o06R0UEgnKqGR7//GPc0LOBhvBrHks3IiyhDYQbGmxlNaM+WGa1wuxnzgOYw9ICW:mR0In3Pc0LCH9MtbvabUDzJYWu3B
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy