ramnit | fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

fb46c81f1c...06.dll

windows7-x64

fb46c81f1c...06.dll

windows10-2004-x64

Sharing

General

Target

fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06
Size

260KB
Sample

221204-b5yrssba7y
MD5

68425b3eb0fb25d2195233d424c8f14f
SHA1

34dd70df3e0e2466be4cf0bb5e9ef4da6d65b2b3
SHA256

fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06
SHA512

f72abe49154b2616581af14cb86063e61559379bcd315484d9896da33efebac6f480f524184f7fdd5c06de6993fa0f570b9a81ff9f8c5ab14bacc9ea28021550
SSDEEP

3072:bm07c4fHCp/AZX/AGUBUpV7Os2kKerYVSrfishHwJjocVFEn8iFINGY9MHwYL9gf:97dHCc/ASsad1rasdUVU8h8OrYeshT

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06.dll

Resource

win7-20220901-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06.dll

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06
- Size
  
  260KB
- MD5
  
  68425b3eb0fb25d2195233d424c8f14f
- SHA1
  
  34dd70df3e0e2466be4cf0bb5e9ef4da6d65b2b3
- SHA256
  
  fb46c81f1c7b9dd8b97c8cbdf713536b4f788b1911849fb7af7e6f308c62db06
- SHA512
  
  f72abe49154b2616581af14cb86063e61559379bcd315484d9896da33efebac6f480f524184f7fdd5c06de6993fa0f570b9a81ff9f8c5ab14bacc9ea28021550
- SSDEEP
  
  3072:bm07c4fHCp/AZX/AGUBUpV7Os2kKerYVSrfishHwJjocVFEn8iFINGY9MHwYL9gf:97dHCc/ASsad1rasdUVU8h8OrYeshT
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy