ramnit | 7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7 | Triage

Submit
Reports

Overview

overview

Static

static

3

7dbb68c035...7N.dll

windows7-x64

7dbb68c035...7N.dll

windows10-2004-x64

Sharing

General

Target

7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7N.exe
Size

782KB
Sample

250104-xzhz2svmdr
MD5

a2c4d1b592436aecb8de221b96e6c3a0
SHA1

3bb3abb98d5fa4bdb8b2fb261f0f26041bd4b6f8
SHA256

7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7
SHA512

4ae7551e126d916fd812b0d2e36e590b7f58c2d86de408981dbfb15292a05f028c6c20f5c912d27c8f0e1ed4fe0687abf4e2d61d5041bce40066084be533ab7b
SSDEEP

24576:4zb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwP1F:4zbKsUmjtcdPGgIwPL

Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7N.dll

Resource

win7-20240903-en

ramnit banker discovery persistence spyware stealer trojan upx worm

windows7-x64

13 signatures

120 seconds

Behavioral task

behavioral2

Sample

7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7N.dll

Resource

win10v2004-20241007-en

ramnit banker discovery spyware stealer trojan upx worm

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7N.exe
- Size
  
  782KB
- MD5
  
  a2c4d1b592436aecb8de221b96e6c3a0
- SHA1
  
  3bb3abb98d5fa4bdb8b2fb261f0f26041bd4b6f8
- SHA256
  
  7dbb68c0352c945a6094c1160c8936f33347b88902db8924ecf055a94e2f19c7
- SHA512
  
  4ae7551e126d916fd812b0d2e36e590b7f58c2d86de408981dbfb15292a05f028c6c20f5c912d27c8f0e1ed4fe0687abf4e2d61d5041bce40066084be533ab7b
- SSDEEP
  
  24576:4zb1MlCKUQyUmjtczu6Prs9pgWoopooK9kwP1F:4zbKsUmjtcdPGgIwPL
Score

10^/10

ramnit banker discovery persistence spyware stealer trojan upx worm
- Modifies WinLogon for persistence
  persistence
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- Ramnit family
  ramnit
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

ramnitbankerdiscoverypersistencespywarestealertrojanupxworm

behavioral2

ramnitbankerdiscoveryspywarestealertrojanupxworm

© 2018-2025

Terms | Privacy