SYMBOLCOMMON_NAMEaka. SYNONYMS
win.ramnit (Back to overview)

Ramnit

aka: Nimnul
VTCollection     URLhaus    

According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries.

Ramnit campaigns have been observed to target organizations in particular industries. For example, a 2019 campaign targeted financial organizations in the United Kingdom, Italy, and Canada.

References
2022-08-18 ⋅ IBM ⋅ Charlotte Hammond, Ole Villadsen
From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers
BumbleBee Karius Ramnit TrickBot Vawtrak
2022-07-12 ⋅ Artik Blue ⋅ Artik Blue
Malware analysis with IDA/Radare2 - Multiple unpacking (Ramnit worm)
Ramnit
2022-01-31 ⋅ IBM ⋅ Itzik Chimino, Limor Kessem
Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data
Ramnit
2022-01-12 ⋅ muha2xmad ⋅ Muhammad Hasan Ali
Unpacking Ramnit malware
Ramnit
2021-10-27 ⋅ Mandiant ⋅ Corey Hildebrandt, Daniel Kapellmann Zafra, Ken Proska, Nathan Brubaker
Portable Executable File Infecting Malware Is Increasingly Found in OT Networks
CCleaner Backdoor Floxif neshta Ramnit Sality Virut
2021-03-31 ⋅ Kaspersky ⋅ Kaspersky
Financial Cyberthreats in 2020
BetaBot DanaBot Emotet Gozi Ramnit RTM SpyEye TrickBot Zeus
2021-02-24 ⋅ IBM ⋅ IBM SECURITY X-FORCE
X-Force Threat Intelligence Index 2021
Emotet QakBot Ramnit REvil TrickBot
2021-01-01 ⋅ Secureworks ⋅ SecureWorks
Threat Profile: GOLD FAIRFAX
Ramnit GOLD FAIRFAX
2020-12-29 ⋅ Youtube (Guided Hacking) ⋅ Guided Hacking
How to Unpack Ramnit Dropper - Malware Unpacking Tutorial 2
Ramnit
2020-10-26 ⋅ Checkpoint ⋅ Eyal Itkin, Itay Cohen
Exploit Developer Spotlight: The Story of PlayBit
Dyre Maze PyLocky Ramnit REvil
2020-08-09 ⋅ F5 Labs ⋅ Debbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-06-17 ⋅ Youtube (Red Canary) ⋅ Adam Pennington, David Kaplan, Erika Noerenberg, Matt Graeber
ATT&CK® Deep Dive: Process Injection
ISFB Ramnit TrickBot
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-01-10 ⋅ CSIS ⋅ CSIS
Threat Matrix H1 2019
Gustuff magecart Emotet Gandcrab Ramnit TrickBot
2019-05-31 ⋅ Youtube (0verfl0w_) ⋅ 0verfl0w_
Defeating Commercial and Custom Packers like a Pro - VMProtect, ASPack, PECompact, and more
FlawedAmmyy Ramnit
2019-02-27 ⋅ Akamai ⋅ Asaf Nadler
Ramnit in the UK
Ramnit
2018-08-05 ⋅ Check Point ⋅ Alexey Bukhteyev
Ramnit’s Network of Proxy Servers
Ngioweb Ramnit
2018-02-22 ⋅ Vitali Kremez
Let's Learn: Deeper Dive into Ramnit Banker "VNC IFSB" Remote Control Module
Ramnit
2018-01-01 ⋅ nao_sec blog ⋅ nao_sec
Analyzing Ramnit used in Seamless campaign
Ramnit
2017-09-29 ⋅ CERT.PL ⋅ Michał Praszmo
Ramnit – in-depth analysis
Ramnit
2017-08-23 ⋅ Malware Breakdown
The Seamless Campaign Isn’t Losing Any Steam
Ramnit
2017-05-03 ⋅ IEEE ⋅ Alok Tongaonkar, Gaspar Modelo-Howard, Lorenzo De Carli, Ruben Torres, Somesh Jha
Botnet Protocol Inference in the Presence of Encrypted Traffic
Ramnit Sality ZeroAccess
2015-02-24 ⋅ Symantec ⋅ Symantec Security Response
W32.Ramnit analysis
Ramnit
2014-12-21 ⋅ bin.re ⋅ Johannes Bader
The DGA of Ramnit
Ramnit
2012-01-12 ⋅ Contagio Dump ⋅ Mila Parkour
Blackhole Ramnit - samples and analysis
Ramnit
Yara Rules
[TLP:WHITE] win_ramnit_auto (20241030 | Detects win.ramnit.)
rule win_ramnit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.ramnit."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 5a 5b c9 c20400 55 8bec }
            // n = 6, score = 4000
            //   5a                   | pop                 edx
            //   5b                   | pop                 ebx
            //   c9                   | leave               
            //   c20400               | ret                 4
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_1 = { 5e 5f 59 5a }
            // n = 4, score = 4000
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi
            //   59                   | pop                 ecx
            //   5a                   | pop                 edx

        $sequence_2 = { 51 52 8b4508 8b5d0c 4b f7d3 23c3 }
            // n = 7, score = 4000
            //   51                   | push                ecx
            //   52                   | push                edx
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]
            //   4b                   | dec                 ebx
            //   f7d3                 | not                 ebx
            //   23c3                 | and                 eax, ebx

        $sequence_3 = { 51 52 8b4508 8b5d0c }
            // n = 4, score = 4000
            //   51                   | push                ecx
            //   52                   | push                edx
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]

        $sequence_4 = { 8b7510 3b7514 7705 3b7d0c 7602 }
            // n = 5, score = 4000
            //   8b7510               | mov                 esi, dword ptr [ebp + 0x10]
            //   3b7514               | cmp                 esi, dword ptr [ebp + 0x14]
            //   7705                 | ja                  7
            //   3b7d0c               | cmp                 edi, dword ptr [ebp + 0xc]
            //   7602                 | jbe                 4

        $sequence_5 = { b800000000 59 5f 5e 5a 5b c9 }
            // n = 7, score = 4000
            //   b800000000           | mov                 eax, 0
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5a                   | pop                 edx
            //   5b                   | pop                 ebx
            //   c9                   | leave               

        $sequence_6 = { 7434 837d1000 742e 837d1400 7428 }
            // n = 5, score = 4000
            //   7434                 | je                  0x36
            //   837d1000             | cmp                 dword ptr [ebp + 0x10], 0
            //   742e                 | je                  0x30
            //   837d1400             | cmp                 dword ptr [ebp + 0x14], 0
            //   7428                 | je                  0x2a

        $sequence_7 = { 8bec 8b4508 3b450c 7603 8b450c c9 c20800 }
            // n = 7, score = 4000
            //   8bec                 | mov                 ebp, esp
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   3b450c               | cmp                 eax, dword ptr [ebp + 0xc]
            //   7603                 | jbe                 5
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   c9                   | leave               
            //   c20800               | ret                 8

        $sequence_8 = { f7d0 48 59 5f }
            // n = 4, score = 4000
            //   f7d0                 | not                 eax
            //   48                   | dec                 eax
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi

        $sequence_9 = { 7512 47 46 e2f6 b801000000 59 }
            // n = 6, score = 4000
            //   7512                 | jne                 0x14
            //   47                   | inc                 edi
            //   46                   | inc                 esi
            //   e2f6                 | loop                0xfffffff8
            //   b801000000           | mov                 eax, 1
            //   59                   | pop                 ecx

    condition:
        7 of them and filesize < 470016
}
[TLP:WHITE] win_ramnit_w0   (20180226 | Detects Ramnit banking malware VNC module)
rule win_ramnit_w0 {
    meta:
        author = "@VK_Intel"
        description = "Detects Ramnit banking malware VNC module"
        reference = "http://www.vkremez.com/2018/02/deeper-dive-into-ramnit-banker-vnc-ifsb.html"
        hash = "888b2c614567fb5b4474ddeeb453f8cd9f44d72efb325f7e3652fd0f748c08f1"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ramnit"
        malpedia_version = "20180226"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s0 = "Failed mapping a section to the target process, status 0x%x" fullword ascii
        $s1 = "Unable to map the section into the target process, error %u" fullword ascii
        $s2 = "Unable to resolve target process import, error %u" fullword ascii
        $s3 = "No module found for the target process (%u) architecture" fullword ascii
        $s4 = "A section of %u bytes mapped to the target process at 0x%p" fullword ascii
        $s5 = "CreateProcessAsUserA %s->%s failed" fullword ascii
        $s6 = "Dep PsSupGetProcessModules, ModCount = %d " fullword ascii
        $s7 = "ActiveDll: PatchProcessMemory failed, error: %u" fullword ascii
        $s8 = "CreateProcessAsUserW %S->%S failed" fullword ascii
        $s9 = "AcInjectDll: GetOEP failed, error: %u" fullword ascii
        $s10 = "Shared section mapped at 0x%p. Starting within VNC session process." fullword ascii
        $s11 = "CreateToolhelp32Snapshot (of processes) failed err=%lu" fullword ascii
    condition:
        all of them
}
Download all Yara Rules