ramnit | 2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19 | Triage

Submit
Reports

Overview

overview

Static

static

3

2ff9a759b1...9N.dll

windows7-x64

2ff9a759b1...9N.dll

windows10-2004-x64

Sharing

General

Target

2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19N.exe
Size

156KB
Sample

241210-v3bn2a1nbz
MD5

cbaea82b71660159af6de5a530d04e20
SHA1

f2d1de3d319fa613d6579c3a3ffdc08dfe2d0d8f
SHA256

2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19
SHA512

4cf29c705eb7b9dec6baad65330e6f29709eb8d2734833689cb0562c40ac2722386c8e98703203677d4df3acb26a76db40cdc3c197d29d74397f27057ac725fa
SSDEEP

3072:ln4cV8gf2u41Z5tKlw6XZufRdL+eONORnKW12hB7:B4y8gOl2puiORnj12hB7

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19N.dll

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

12 signatures

120 seconds

Behavioral task

behavioral2

Sample

2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19N.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

120 seconds

Malware Config

Targets

- Target
  
  2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19N.exe
- Size
  
  156KB
- MD5
  
  cbaea82b71660159af6de5a530d04e20
- SHA1
  
  f2d1de3d319fa613d6579c3a3ffdc08dfe2d0d8f
- SHA256
  
  2ff9a759b1a15d61783762a9c3595a0983972d5e8117b4ad30239ad40f43dd19
- SHA512
  
  4cf29c705eb7b9dec6baad65330e6f29709eb8d2734833689cb0562c40ac2722386c8e98703203677d4df3acb26a76db40cdc3c197d29d74397f27057ac725fa
- SSDEEP
  
  3072:ln4cV8gf2u41Z5tKlw6XZufRdL+eONORnKW12hB7:B4y8gOl2puiORnj12hB7
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy