ramnit | 1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

1420fd484e...9N.dll

windows7-x64

1420fd484e...9N.dll

windows10-2004-x64

Sharing

General

Target

1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999N.exe
Size

400KB
Sample

241210-mgejssyjfl
MD5

9af9640d3f6cb20a41f1a54b75cc5750
SHA1

5cb3ca3cac330086463379aa74b77bcea1d31a65
SHA256

1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999
SHA512

a5b6e45b61d76e12ba8a926e532c870c94dde204e22ab5d06a2062498dd54be25cb0ca8cd118e142d8132ef07c28ca92b9ed4361684d184b462f8fdd31d8cdb9
SSDEEP

6144:ScV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE/99y:Soz83OtIEzW+/m/AyF7bCrO/E/n67

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999N.dll

Resource

win7-20240903-en

ramnit banker discovery spyware stealer trojan upx worm

windows7-x64

14 signatures

120 seconds

Behavioral task

behavioral2

Sample

1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999N.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

13 signatures

120 seconds

Malware Config

Targets

- Target
  
  1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999N.exe
- Size
  
  400KB
- MD5
  
  9af9640d3f6cb20a41f1a54b75cc5750
- SHA1
  
  5cb3ca3cac330086463379aa74b77bcea1d31a65
- SHA256
  
  1420fd484ec6a64977a796034fb7e575a1970533135d6cc058c98719e4530999
- SHA512
  
  a5b6e45b61d76e12ba8a926e532c870c94dde204e22ab5d06a2062498dd54be25cb0ca8cd118e142d8132ef07c28ca92b9ed4361684d184b462f8fdd31d8cdb9
- SSDEEP
  
  6144:ScV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE/99y:Soz83OtIEzW+/m/AyF7bCrO/E/n67
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy