ramnit | ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149 | Triage

Submit
Reports

Overview

overview

Static

static

3

ea2bfa8b4a...49.exe

windows7-x64

ea2bfa8b4a...49.exe

windows10-2004-x64

7

Sharing

General

Target

ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149
Size

137KB
Sample

241215-zgjjzawney
MD5

6328dc3740cb460bbeb01f9e1f8c3a96
SHA1

75727567341a0b2c441344f60a0b544b68a6212b
SHA256

ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149
SHA512

6563a6b984280b45fcd77a45c629136b9e21b86e9bc7c5363b6a511ab03c711028198d77cb855829f439dafd9b162255d4a36297e74c27af6057e960c28eb90a
SSDEEP

3072:zmftffhJCuU9Cw7vFoF3M9Z8oU8HGROzoTq0+RO7IwnY:KVfhguMCysgZNYkdNwB

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149.exe

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149
- Size
  
  137KB
- MD5
  
  6328dc3740cb460bbeb01f9e1f8c3a96
- SHA1
  
  75727567341a0b2c441344f60a0b544b68a6212b
- SHA256
  
  ea2bfa8b4a21ed0d5a9007e8697fbadbcd374ab0c8de1e065afe13bea621e149
- SHA512
  
  6563a6b984280b45fcd77a45c629136b9e21b86e9bc7c5363b6a511ab03c711028198d77cb855829f439dafd9b162255d4a36297e74c27af6057e960c28eb90a
- SSDEEP
  
  3072:zmftffhJCuU9Cw7vFoF3M9Z8oU8HGROzoTq0+RO7IwnY:KVfhguMCysgZNYkdNwB
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

© 2018-2025

Terms | Privacy