RamnitMalware
- nimnul
According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries. Ramnit campaigns have been observed to target organizations in particular industries.From MISP Galaxy
Last reported 5 years ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1110Brute Force
“Most often, scammers exploit vulnerabilities in the website code or use brute-force to deliver the script.”
- T1505.003Web Shell
“There are scripts that open web shells on hosting resources unknown to the buyer of the kit.”
What the reports say
1 report, newest first · the exact sentence from each-
Deep water: exploring phishing kits“… examined by CERT-GIB allowed the scammers to create a temporary file using the VBScript language and then add the malicious code of the Ramnit worm to it in binary form, byte by byte.”
Indicators in its reports
named in the reports above- ite[.]comin 1 report
- aafedc957d39b975c5d15413825b033fin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.