ramnit | aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

aba55ba555...aa.dll

windows7-x64

aba55ba555...aa.dll

windows10-2004-x64

Sharing

General

Target

aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa
Size

156KB
Sample

221127-yawqaadb37
MD5

be04cb75888afe3e1076f03ea7437d81
SHA1

69048dd422408cdb8537f6dbd0cdee6a90f70e93
SHA256

aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa
SHA512

e31eaf8e958d153e7c2c3ee1f4962a908ac6256fd217a440fb58f1522d09f53b056606aef43f5621be5a34298b7d519069c9ae65e15c98ff27c17df310a98dab
SSDEEP

3072:3vY2M8wRBjnPWMowyrR1PFOH4jI/PGYMFMQ1iK9LhBttAXOeIZQoXT3V:TiPWMowyrDC4jI/PGr1i+hBRqo

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Static task

static1

Behavioral task

behavioral1

Sample

aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa.dll

Resource

win7-20220812-en

ramnit banker evasion persistence spyware stealer trojan worm

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral2

Sample

aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa.dll

Resource

win10v2004-20220812-en

ramnit banker evasion spyware stealer trojan worm

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa
- Size
  
  156KB
- MD5
  
  be04cb75888afe3e1076f03ea7437d81
- SHA1
  
  69048dd422408cdb8537f6dbd0cdee6a90f70e93
- SHA256
  
  aba55ba555f43f1fccb63b640c87a347bbca236bf19107dd1f33412cefb03baa
- SHA512
  
  e31eaf8e958d153e7c2c3ee1f4962a908ac6256fd217a440fb58f1522d09f53b056606aef43f5621be5a34298b7d519069c9ae65e15c98ff27c17df310a98dab
- SSDEEP
  
  3072:3vY2M8wRBjnPWMowyrR1PFOH4jI/PGYMFMQ1iK9LhBttAXOeIZQoXT3V:TiPWMowyrDC4jI/PGr1i+hBRqo
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerevasionspywarestealertrojanworm

© 2018-2025

Terms | Privacy