ramnit | 09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9 | Triage

Submit
Reports

Overview

overview

Static

static

3

09ae112086...d9.dll

windows7-x64

09ae112086...d9.dll

windows10-2004-x64

Sharing

General

Target

09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9
Size

4.2MB
Sample

241119-qdk4ysxbqp
MD5

27f2fca9813a61077a1c3c0cfcdb21e0
SHA1

f371f543b5d34bc269530d72d62dd1f51b03abc3
SHA256

09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9
SHA512

46df025cf9567bbefec1b1478c4161cb43b633a4f300ae65a0ef1c3d5289d81a24659599b757712c11e3e2dd5d71971bc3011e2ea4036cc8459a07d74da9e5e0
SSDEEP

98304:Oaun0sM5Hnc30M/Op4yFARPbsC3kZ1ec0cIHgBG2szOJqNjRyG7Slcj0/5/9saFP:Oaun0sM5i/1NYw6cN4y

Score

10^/10

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9.dll

Resource

win7-20240903-en

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9.dll

Resource

win10v2004-20241007-en

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9
- Size
  
  4.2MB
- MD5
  
  27f2fca9813a61077a1c3c0cfcdb21e0
- SHA1
  
  f371f543b5d34bc269530d72d62dd1f51b03abc3
- SHA256
  
  09ae112086a810b890cf0253f2ed1f3378c9394fc30ac5058258730cc9eb12d9
- SHA512
  
  46df025cf9567bbefec1b1478c4161cb43b633a4f300ae65a0ef1c3d5289d81a24659599b757712c11e3e2dd5d71971bc3011e2ea4036cc8459a07d74da9e5e0
- SSDEEP
  
  98304:Oaun0sM5Hnc30M/Op4yFARPbsC3kZ1ec0cIHgBG2szOJqNjRyG7Slcj0/5/9saFP:Oaun0sM5i/1NYw6cN4y
Score

10^/10

ramnit banker bootkit discovery persistence spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerbootkitdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerbootkitdiscoverypersistencespywarestealertrojanupxworm

© 2018-2025

Terms | Privacy