ramnit | 48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149 | Triage

Submit
Reports

Overview

overview

Static

static

48999a898a...49.dll

windows7-x64

48999a898a...49.dll

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target

48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149
Size

677KB
Sample

221204-cvbd7ada9x
MD5

a0073f70dc28ae4bacd6ebae831efaf0
SHA1

ec809cba09e157b3902344cb5bf251fec18d1482
SHA256

48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149
SHA512

0a89df10c6f4c2f09f0c5210deefe8991437e327c6ec04943a7bb9aa0994d13c1fbd2989e646a783c5734527805535665e913aa1287f9ae096408ff351b21ced
SSDEEP

12288:sNIyZN4+Wv4PLq6Okrh9ZN/hs9DsdseTTPvEK:s9TPmirh9Zdh6LeTTnEK

Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm

Static task

static1

Behavioral task

behavioral1

Sample

48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149.dll

Resource

win7-20221111-en

ramnit banker persistence spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149.dll

Resource

win10v2004-20220812-en

ramnit banker spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149
- Size
  
  677KB
- MD5
  
  a0073f70dc28ae4bacd6ebae831efaf0
- SHA1
  
  ec809cba09e157b3902344cb5bf251fec18d1482
- SHA256
  
  48999a898a10b4cd18d5214645a1237b5ad68cf10f20f843e98d14e0e178a149
- SHA512
  
  0a89df10c6f4c2f09f0c5210deefe8991437e327c6ec04943a7bb9aa0994d13c1fbd2989e646a783c5734527805535665e913aa1287f9ae096408ff351b21ced
- SSDEEP
  
  12288:sNIyZN4+Wv4PLq6Okrh9ZN/hs9DsdseTTPvEK:s9TPmirh9Zdh6LeTTnEK
Score

10^/10

ramnit banker persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerpersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy