ramnit | a7ac41929b98d6a98facd3126cef7c77c004b6851e5ebf94046d0457549220f0 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...d0.exe

windows7-x64

JaffaCakes...d0.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_553557ef2951e5961f072119afd6e9d0
Size

401KB
Sample

250101-pqbklsxlgl
MD5

553557ef2951e5961f072119afd6e9d0
SHA1

bad2d5bf60655ba2cb0f8f64b8cb46ad25923c2b
SHA256

a7ac41929b98d6a98facd3126cef7c77c004b6851e5ebf94046d0457549220f0
SHA512

d89a9bd414f5466c5c69aafb1f9e61aaa36a60afe8b53fc6695ff829693715ff65ffcfcdf0e955cb2e72eb85e3ac94d194f2fb86c325870533302875dff48f7e
SSDEEP

3072:fT2xNfzEmPUac0yCRS9EK0TLmf8HVt1up3H1kvco0OjMsdbxloEGpfcCwOqL5pdb:7kPpe0m0HVt16IloEGRcCwhrkTlPfg

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_553557ef2951e5961f072119afd6e9d0.exe

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_553557ef2951e5961f072119afd6e9d0.exe

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_553557ef2951e5961f072119afd6e9d0
- Size
  
  401KB
- MD5
  
  553557ef2951e5961f072119afd6e9d0
- SHA1
  
  bad2d5bf60655ba2cb0f8f64b8cb46ad25923c2b
- SHA256
  
  a7ac41929b98d6a98facd3126cef7c77c004b6851e5ebf94046d0457549220f0
- SHA512
  
  d89a9bd414f5466c5c69aafb1f9e61aaa36a60afe8b53fc6695ff829693715ff65ffcfcdf0e955cb2e72eb85e3ac94d194f2fb86c325870533302875dff48f7e
- SSDEEP
  
  3072:fT2xNfzEmPUac0yCRS9EK0TLmf8HVt1up3H1kvco0OjMsdbxloEGpfcCwOqL5pdb:7kPpe0m0HVt16IloEGRcCwhrkTlPfg
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy