SYMBOLCOMMON_NAMEaka. SYNONYMS
win.ramnit (Back to overview)

Ramnit

aka: Nimnul
URLhaus    

There is no description at this point.

References
2021-03-31KasperskyKaspersky
@online{kaspersky:20210331:financial:3371aa0, author = {Kaspersky}, title = {{Financial Cyberthreats in 2020}}, date = {2021-03-31}, organization = {Kaspersky}, url = {https://securelist.com/financial-cyberthreats-in-2020/101638/}, language = {English}, urldate = {2021-04-06} } Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2021-02-24IBMIBM SECURITY X-FORCE
@online{xforce:20210224:xforce:ac9a90e, author = {IBM SECURITY X-FORCE}, title = {{X-Force Threat Intelligence Index 2021}}, date = {2021-02-24}, organization = {IBM}, url = {https://ibm.ent.box.com/s/hs5pcayhbbhjvj8di5sqdpbbd88tsh89}, language = {English}, urldate = {2021-03-02} } X-Force Threat Intelligence Index 2021
Emotet QakBot Ramnit REvil TrickBot
2021SecureworksSecureWorks
@online{secureworks:2021:threat:197feaf, author = {SecureWorks}, title = {{Threat Profile: GOLD FAIRFAX}}, date = {2021}, organization = {Secureworks}, url = {http://www.secureworks.com/research/threat-profiles/gold-fairfax}, language = {English}, urldate = {2021-05-31} } Threat Profile: GOLD FAIRFAX
Ramnit GOLD FAIRFAX
2020-12-29Youtube (Guided Hacking)Guided Hacking
@online{hacking:20201229:how:401dbfb, author = {Guided Hacking}, title = {{How to Unpack Ramnit Dropper - Malware Unpacking Tutorial 2}}, date = {2020-12-29}, organization = {Youtube (Guided Hacking)}, url = {https://www.youtube.com/watch?v=l6ZunH6YG0A}, language = {English}, urldate = {2021-01-11} } How to Unpack Ramnit Dropper - Malware Unpacking Tutorial 2
Ramnit
2020-10-26CheckpointItay Cohen, Eyal Itkin
@online{cohen:20201026:exploit:9ec173c, author = {Itay Cohen and Eyal Itkin}, title = {{Exploit Developer Spotlight: The Story of PlayBit}}, date = {2020-10-26}, organization = {Checkpoint}, url = {https://research.checkpoint.com/2020/graphology-of-an-exploit-playbit/}, language = {English}, urldate = {2020-10-27} } Exploit Developer Spotlight: The Story of PlayBit
Dyre Maze PyLocky Ramnit REvil
2020-08-09F5 LabsRemi Cohen, Debbie Walkowski
@online{cohen:20200809:banking:8718999, author = {Remi Cohen and Debbie Walkowski}, title = {{Banking Trojans: A Reference Guide to the Malware Family Tree}}, date = {2020-08-09}, organization = {F5 Labs}, url = {https://www.f5.com/labs/articles/education/banking-trojans-a-reference-guide-to-the-malware-family-tree}, language = {English}, urldate = {2021-06-29} } Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-06-17Youtube (Red Canary)Erika Noerenberg, Matt Graeber, Adam Pennington, David Kaplan
@online{noerenberg:20200617:attck:934d73c, author = {Erika Noerenberg and Matt Graeber and Adam Pennington and David Kaplan}, title = {{ATT&CK® Deep Dive: Process Injection}}, date = {2020-06-17}, organization = {Youtube (Red Canary)}, url = {https://redcanary.com/resources/webinars/deep-dive-process-injection/}, language = {English}, urldate = {2020-06-19} } ATT&CK® Deep Dive: Process Injection
ISFB Ramnit TrickBot
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare Axiom
2020-01-10CSISCSIS
@techreport{csis:20200110:threat:7454f36, author = {CSIS}, title = {{Threat Matrix H1 2019}}, date = {2020-01-10}, institution = {CSIS}, url = {https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf}, language = {English}, urldate = {2020-01-22} } Threat Matrix H1 2019
Gustuff magecart Emotet Gandcrab Ramnit TrickBot
2019-05-31Youtube (0verfl0w_)0verfl0w_
@online{0verfl0w:20190531:defeating:eb0994e, author = {0verfl0w_}, title = {{Defeating Commercial and Custom Packers like a Pro - VMProtect, ASPack, PECompact, and more}}, date = {2019-05-31}, organization = {Youtube (0verfl0w_)}, url = {https://www.youtube.com/watch?v=N4f2e8Mygag}, language = {English}, urldate = {2020-01-08} } Defeating Commercial and Custom Packers like a Pro - VMProtect, ASPack, PECompact, and more
FlawedAmmyy Ramnit
2019-02-27AkamaiAsaf Nadler
@online{nadler:20190227:ramnit:e00b14d, author = {Asaf Nadler}, title = {{Ramnit in the UK}}, date = {2019-02-27}, organization = {Akamai}, url = {https://blogs.akamai.com/2019/02/ramnit-in-the-uk.html}, language = {English}, urldate = {2020-07-03} } Ramnit in the UK
Ramnit
2018-08-05Check PointAlexey Bukhteyev
@online{bukhteyev:20180805:ramnits:1268bad, author = {Alexey Bukhteyev}, title = {{Ramnit’s Network of Proxy Servers}}, date = {2018-08-05}, organization = {Check Point}, url = {https://research.checkpoint.com/ramnits-network-proxy-servers/}, language = {English}, urldate = {2020-01-09} } Ramnit’s Network of Proxy Servers
Ngioweb Ramnit
2018-02-22Vitali Kremez
@online{kremez:20180222:lets:6fd91bb, author = {Vitali Kremez}, title = {{Let's Learn: Deeper Dive into Ramnit Banker "VNC IFSB" Remote Control Module}}, date = {2018-02-22}, url = {http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html}, language = {English}, urldate = {2019-12-04} } Let's Learn: Deeper Dive into Ramnit Banker "VNC IFSB" Remote Control Module
Ramnit
2018-01-01nao_sec blognao_sec
@online{naosec:20180101:analyzing:0efde89, author = {nao_sec}, title = {{Analyzing Ramnit used in Seamless campaign}}, date = {2018-01-01}, organization = {nao_sec blog}, url = {http://www.nao-sec.org/2018/01/analyzing-ramnit-used-in-seamless.html}, language = {English}, urldate = {2020-01-08} } Analyzing Ramnit used in Seamless campaign
Ramnit
2017-09-29CERT.PLMichał Praszmo
@online{praszmo:20170929:ramnit:0ab2a9e, author = {Michał Praszmo}, title = {{Ramnit – in-depth analysis}}, date = {2017-09-29}, organization = {CERT.PL}, url = {https://www.cert.pl/en/news/single/ramnit-in-depth-analysis/}, language = {English}, urldate = {2020-01-13} } Ramnit – in-depth analysis
Ramnit
2017-08-23Malware Breakdown
@online{breakdown:20170823:seamless:3a2c794, author = {Malware Breakdown}, title = {{The Seamless Campaign Isn’t Losing Any Steam}}, date = {2017-08-23}, url = {https://malwarebreakdown.com/2017/08/23/the-seamless-campaign-isnt-losing-any-steam/}, language = {English}, urldate = {2019-12-04} } The Seamless Campaign Isn’t Losing Any Steam
Ramnit
2015-02-24SymantecSymantec Security Response
@techreport{response:20150224:w32ramnit:3a2fed3, author = {Symantec Security Response}, title = {{W32.Ramnit analysis}}, date = {2015-02-24}, institution = {Symantec}, url = {https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/w32-ramnit-analysis-15-en.pdf}, language = {English}, urldate = {2019-12-17} } W32.Ramnit analysis
Ramnit
2012-01-12Contagio DumpMila Parkour
@online{parkour:20120112:blackhole:c99cf1f, author = {Mila Parkour}, title = {{Blackhole Ramnit - samples and analysis}}, date = {2012-01-12}, organization = {Contagio Dump}, url = {http://contagiodump.blogspot.com/2012/01/blackhole-ramnit-samples-and-analysis.html}, language = {English}, urldate = {2019-12-20} } Blackhole Ramnit - samples and analysis
Ramnit
Yara Rules
[TLP:WHITE] win_ramnit_auto (20210616 | Detects win.ramnit.)
rule win_ramnit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-06-10"
        version = "1"
        description = "Detects win.ramnit."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
        malpedia_rule_date = "20210604"
        malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd"
        malpedia_version = "20210616"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3b450c 7603 8b450c c9 c20800 55 }
            // n = 6, score = 4000
            //   3b450c               | cmp                 eax, dword ptr [ebp + 0xc]
            //   7603                 | jbe                 5
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   c9                   | leave               
            //   c20800               | ret                 8
            //   55                   | push                ebp

        $sequence_1 = { 8a07 3a4510 7407 b800000000 eb02 8bc7 }
            // n = 6, score = 4000
            //   8a07                 | mov                 al, byte ptr [edi]
            //   3a4510               | cmp                 al, byte ptr [ebp + 0x10]
            //   7407                 | je                  9
            //   b800000000           | mov                 eax, 0
            //   eb02                 | jmp                 4
            //   8bc7                 | mov                 eax, edi

        $sequence_2 = { 59 5f 5e c9 c21000 8b45fc }
            // n = 6, score = 4000
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   c9                   | leave               
            //   c21000               | ret                 0x10
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_3 = { f7d3 23c3 5a 59 5b }
            // n = 5, score = 4000
            //   f7d3                 | not                 ebx
            //   23c3                 | and                 eax, ebx
            //   5a                   | pop                 edx
            //   59                   | pop                 ecx
            //   5b                   | pop                 ebx

        $sequence_4 = { 51 57 56 fc 807d1401 }
            // n = 5, score = 4000
            //   51                   | push                ecx
            //   57                   | push                edi
            //   56                   | push                esi
            //   fc                   | cld                 
            //   807d1401             | cmp                 byte ptr [ebp + 0x14], 1

        $sequence_5 = { 8bf8 037d14 3b7df8 771f 8945fc }
            // n = 5, score = 4000
            //   8bf8                 | mov                 edi, eax
            //   037d14               | add                 edi, dword ptr [ebp + 0x14]
            //   3b7df8               | cmp                 edi, dword ptr [ebp - 8]
            //   771f                 | ja                  0x21
            //   8945fc               | mov                 dword ptr [ebp - 4], eax

        $sequence_6 = { c9 c21000 55 8bec 83c4fc 56 }
            // n = 6, score = 4000
            //   c9                   | leave               
            //   c21000               | ret                 0x10
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83c4fc               | add                 esp, -4
            //   56                   | push                esi

        $sequence_7 = { 57 51 53 52 837d0800 }
            // n = 5, score = 4000
            //   57                   | push                edi
            //   51                   | push                ecx
            //   53                   | push                ebx
            //   52                   | push                edx
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0

        $sequence_8 = { 8ac3 50 ff750c ff75fc e8???????? }
            // n = 5, score = 4000
            //   8ac3                 | mov                 al, bl
            //   50                   | push                eax
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   e8????????           |                     

        $sequence_9 = { 56 fc 8b4d0c 8b7d08 b000 f3aa 5e }
            // n = 7, score = 4000
            //   56                   | push                esi
            //   fc                   | cld                 
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   b000                 | mov                 al, 0
            //   f3aa                 | rep stosb           byte ptr es:[edi], al
            //   5e                   | pop                 esi

    condition:
        7 of them and filesize < 470016
}
[TLP:WHITE] win_ramnit_w0   (20180226 | Detects Ramnit banking malware VNC module)
rule win_ramnit_w0 {
    meta:
        author = "@VK_Intel"
        description = "Detects Ramnit banking malware VNC module"
        reference = "http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html"
        hash = "888b2c614567fb5b4474ddeeb453f8cd9f44d72efb325f7e3652fd0f748c08f1"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
        malpedia_version = "20180226"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s0 = "Failed mapping a section to the target process, status 0x%x" fullword ascii
        $s1 = "Unable to map the section into the target process, error %u" fullword ascii
        $s2 = "Unable to resolve target process import, error %u" fullword ascii
        $s3 = "No module found for the target process (%u) architecture" fullword ascii
        $s4 = "A section of %u bytes mapped to the target process at 0x%p" fullword ascii
        $s5 = "CreateProcessAsUserA %s->%s failed" fullword ascii
        $s6 = "Dep PsSupGetProcessModules, ModCount = %d " fullword ascii
        $s7 = "ActiveDll: PatchProcessMemory failed, error: %u" fullword ascii
        $s8 = "CreateProcessAsUserW %S->%S failed" fullword ascii
        $s9 = "AcInjectDll: GetOEP failed, error: %u" fullword ascii
        $s10 = "Shared section mapped at 0x%p. Starting within VNC session process." fullword ascii
        $s11 = "CreateToolhelp32Snapshot (of processes) failed err=%lu" fullword ascii
    condition:
        all of them
}
Download all Yara Rules