MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 cfa1b613290dd96e58d12317a1bd0a2d557f0ba6ba1b6f3dc5dc59c8cc9beb6c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Ramnit
Vendor detections: 14
| SHA256 hash: | cfa1b613290dd96e58d12317a1bd0a2d557f0ba6ba1b6f3dc5dc59c8cc9beb6c |
|---|---|
| SHA3-384 hash: | f5f03b933840bc4a0c9521e348a375ea012bf5518c882883a1aecac28cf52495b0785d1923b55a3301d13255b11c327d |
| SHA1 hash: | d0a2c145c4dcacc089e0ec87a83bdcdc9304bd40 |
| MD5 hash: | 3413b76a95e64a6445a1a61f8a6db295 |
| humanhash: | hamper-massachusetts-lactose-hamper |
| File name: | sample |
| Download: | download sample |
| Signature | Ramnit |
| File size: | 1'214'464 bytes |
| First seen: | 2022-06-01 18:07:48 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | a49977b0f9a42d88116ab0c5adc7799e (1 x Ramnit) |
| ssdeep | 24576:LAyXX8qif7h9RHyevHQdsXQaz27MMMMMM3s5xE3DQ:LuF7h9RH/H+QQaMMMMMMMKE3k |
| Threatray | 11'931 similar samples on MalwareBazaar |
| TLSH | T101459E61B7DAC032F9761EB014B9B309293EBA220774CDDFA7902D5E5931AD29D7034B |
| TrID | 46.5% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 34.6% (.CPL) Windows Control Panel Item (generic) (197083/11/60) 7.5% (.EXE) InstallShield setup (43053/19/16) 5.4% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 1.8% (.EXE) Win64 Executable (generic) (10523/12/4) |
| File icon (PE): |  |
| dhash icon | cdebeaaebaeefa8c (1 x Ramnit, 1 x DCRat, 1 x Neurevt) |
| Reporter | Anonymous |
| Tags: | 32-bit exe ramnit |
Intelligence
File Origin
# of uploads :
1
# of downloads :
641
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
ramnit
ID:
1
File name:
sample
Verdict:
Malicious activity
Analysis date:
2022-06-01 18:11:21 UTC
Tags:
installer trojan ramnit
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file
Creating a process from a recently created file
Creating a file in the Program Files subdirectories
Changing a file
Creating a window
Launching a process
Searching for synchronization primitives
Unauthorized injection to a recently created process
Searching for the browser window
Sending a custom TCP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Ramnit
Verdict:
Malicious
Result
Threat name:
Ramnit
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Ramnit
Behaviour
Behavior Graph:
Detection:
ramnit
Threat name:
Win32.Worm.Ramnit
Status:
Malicious
First seen:
2015-05-23 13:45:32 UTC
File Type:
PE (Exe)
Extracted files:
127
AV detection:
25 of 25 (100.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 11'921 additional samples on MalwareBazaar
Result
Malware family:
ramnit
Score:
10/10
Tags:
family:ramnit banker persistence spyware stealer trojan upx worm
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Loads dropped DLL
Executes dropped EXE
UPX packed file
Modifies system executable filetype association
Ramnit
Unpacked files
SH256 hash:
624c41a674148696330c7021f0b4c1b45b3f1ba1eb5087a1f81297d11841aa55
MD5 hash:
99eaca96d7128348a76019dd67aefcc5
SHA1 hash:
4f2b9ee0018b61aa9db25b02603330d9a98ae453
Detections:
win_ramnit_g1
win_ramnit_auto
SH256 hash:
f515564b67efd06fa42f57532feafc49d40b0fc36c5d4935300dd55416f0a386
MD5 hash:
17efb7e40d4cadaf3a4369435a8772ec
SHA1 hash:
eb9302063ac2ab599ae93aaa1e45b88bbeacbca2
SH256 hash:
cfa1b613290dd96e58d12317a1bd0a2d557f0ba6ba1b6f3dc5dc59c8cc9beb6c
MD5 hash:
3413b76a95e64a6445a1a61f8a6db295
SHA1 hash:
d0a2c145c4dcacc089e0ec87a83bdcdc9304bd40
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.