ramnit | db1420a2ff6a29f63ed3da12087155231cce82b4550e20cd31fb287e44832514 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...60.dll

windows7-x64

JaffaCakes...60.dll

windows10-2004-x64

7

Sharing

General

Target

JaffaCakes118_5a515ccdbfb76acf91839684585abf60
Size

137KB
Sample

250101-svb9gszndy
MD5

5a515ccdbfb76acf91839684585abf60
SHA1

16a18160a614bdc5a7796c99853b127cb362bc2d
SHA256

db1420a2ff6a29f63ed3da12087155231cce82b4550e20cd31fb287e44832514
SHA512

e83e06ed0d6c1fcf0590d8e595f41d754e2cc44133401efea07683f8f8195121296a896ec68aa30372087f9e2196fc30eca9dd51970f9cbcb5e5ff6e00b1d82b
SSDEEP

3072:/NqgwmI488TRAfVhBQ7P+0Us4Q+LQI1H2UJ2mro/Y:svmlAfVhy75ZlIx2Svo/Y

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_5a515ccdbfb76acf91839684585abf60.dll

Resource

win7-20240903-en

ramnit banker discovery spyware stealer trojan upx worm

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_5a515ccdbfb76acf91839684585abf60.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_5a515ccdbfb76acf91839684585abf60
- Size
  
  137KB
- MD5
  
  5a515ccdbfb76acf91839684585abf60
- SHA1
  
  16a18160a614bdc5a7796c99853b127cb362bc2d
- SHA256
  
  db1420a2ff6a29f63ed3da12087155231cce82b4550e20cd31fb287e44832514
- SHA512
  
  e83e06ed0d6c1fcf0590d8e595f41d754e2cc44133401efea07683f8f8195121296a896ec68aa30372087f9e2196fc30eca9dd51970f9cbcb5e5ff6e00b1d82b
- SSDEEP
  
  3072:/NqgwmI488TRAfVhBQ7P+0Us4Q+LQI1H2UJ2mro/Y:svmlAfVhy75ZlIx2Svo/Y
Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoveryspywarestealertrojanupxworm

behavioral2

© 2018-2025

Terms | Privacy