ramnit | dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

dc04bf89c0...a4.exe

windows7-x64

dc04bf89c0...a4.exe

windows10-2004-x64

Sharing

General

Target

dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4
Size

726KB
Sample

221121-mbxs7aee58
MD5

36f85d3245e1b8bb38c616b30ab1f640
SHA1

4be3c95e83506a8ac06946080d7f40676f6db204
SHA256

dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4
SHA512

eb6353f7b545a79e297587342eff8358284033b5599ca8774156a1fe985087e17c6dd9a7f1b354d803316386a13d5ceb661506cc7303b73ab330b2d67b2abb0d
SSDEEP

12288:WD9nRRdXf9fmfMdVqnISTgXTzILCWHXJY1mVxwjKN2vtEOEQS:299n/qnIsgXT8PHXJU

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4.exe

Resource

win7-20221111-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4.exe

Resource

win10v2004-20220901-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4
- Size
  
  726KB
- MD5
  
  36f85d3245e1b8bb38c616b30ab1f640
- SHA1
  
  4be3c95e83506a8ac06946080d7f40676f6db204
- SHA256
  
  dc04bf89c0a473aa65c8f603c03cb95bbb3ecb3bc5699f6a23072fa02c3614a4
- SHA512
  
  eb6353f7b545a79e297587342eff8358284033b5599ca8774156a1fe985087e17c6dd9a7f1b354d803316386a13d5ceb661506cc7303b73ab330b2d67b2abb0d
- SSDEEP
  
  12288:WD9nRRdXf9fmfMdVqnISTgXTzILCWHXJY1mVxwjKN2vtEOEQS:299n/qnIsgXT8PHXJU
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy