ramnit | 44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

44bef2e977...71.dll

windows7-x64

44bef2e977...71.dll

windows10-2004-x64

7

Sharing

General

Target

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
Size

189KB
Sample

231117-tfmx4saf54
MD5

bb47f696fcecf06265d90a3c5747a8b2
SHA1

d154cf58a0f8ccdb309696c63fd8bf9740d55f8c
SHA256

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
SHA512

ef77527b2b0637f047fdbf15ad11ee82ab16721da45491a0988dce14985ac5b49f0a1b1dac2bb5558024b9f36145436795ccbcb5e0ea0f8be2ed5fb0f7f73162
SSDEEP

3072:FjB3UkpquSNj39ZwjqgeUl1MvZv79m/wKtGlKPgbY+CJyUKLXOLwbMPMZdpIH:tB3UkpquSNzLwxeWsZj9WuGTyUGOcbM/

Score

10^/10

ramnit banker spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll

Resource

win7-20231020-en

ramnit banker spyware stealer trojan upx worm

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71.dll

Resource

win10v2004-20231020-en

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
- Size
  
  189KB
- MD5
  
  bb47f696fcecf06265d90a3c5747a8b2
- SHA1
  
  d154cf58a0f8ccdb309696c63fd8bf9740d55f8c
- SHA256
  
  44bef2e9777216494d72005804aeb0db565d467ca68c1cb34be5e984f5768c71
- SHA512
  
  ef77527b2b0637f047fdbf15ad11ee82ab16721da45491a0988dce14985ac5b49f0a1b1dac2bb5558024b9f36145436795ccbcb5e0ea0f8be2ed5fb0f7f73162
- SSDEEP
  
  3072:FjB3UkpquSNj39ZwjqgeUl1MvZv79m/wKtGlKPgbY+CJyUKLXOLwbMPMZdpIH:tB3UkpquSNzLwxeWsZj9WuGTyUGOcbM/
Score

10^/10

ramnit banker spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerspywarestealertrojanupxworm

behavioral2

© 2018-2025

Terms | Privacy