ramnit | a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3 | Triage

Submit
Reports

Overview

overview

Static

static

a1a4b638fa...c3.exe

windows7-x64

a1a4b638fa...c3.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3
Size

101KB
Sample

221129-exdcnsdg24
MD5

eb27e26aab741f30ad324ebf176325e4
SHA1

9394410fe2ccc392a5d5d5afe0cf6fa36d0b6b1d
SHA256

a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3
SHA512

eb984df01e8d84f0295521350bed8d354f2cb9a3a7efccf26d40cdf199d61e64dfceba34c9b9e70bf1b302422c331e51f86105811119b4559a1a06d0ed1a53db
SSDEEP

3072:9gIpT1t2YXm8XdstQculie6qbcU5jwaaHw7Koj4r:aIx1dX3XCt2bB

Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm

Static task

static1

Behavioral task

behavioral1

Sample

a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3.exe

Resource

win7-20221111-en

ramnit banker evasion persistence spyware stealer trojan worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3.exe

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan worm

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3
- Size
  
  101KB
- MD5
  
  eb27e26aab741f30ad324ebf176325e4
- SHA1
  
  9394410fe2ccc392a5d5d5afe0cf6fa36d0b6b1d
- SHA256
  
  a1a4b638fa64136abf641c807a9c3fa1f639a1be4823d3c5cd95092766405ac3
- SHA512
  
  eb984df01e8d84f0295521350bed8d354f2cb9a3a7efccf26d40cdf199d61e64dfceba34c9b9e70bf1b302422c331e51f86105811119b4559a1a06d0ed1a53db
- SSDEEP
  
  3072:9gIpT1t2YXm8XdstQculie6qbcU5jwaaHw7Koj4r:aIx1dX3XCt2bB
Score

10^/10

ramnit banker evasion persistence spyware stealer trojan worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- UAC bypass
  evasion trojan
- Executes dropped EXE
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Bypass User Account Control

Defense Evasion

Bypass User Account Control

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerevasionpersistencespywarestealertrojanworm

behavioral2

ramnitbankerspywarestealertrojanworm

© 2018-2025

Terms | Privacy