[rkhunter]

Ramnit virus dropper - Trojan:Win32/Ramnit.A.
Performs a lot of system modifications, http://www.threatexpert.com/report.aspx ... c63c285a80

14 /43 >> 32.6%

Edit: extracted infector added - Virus:Win32/Ramnit.AF.

MD5: fe2d59a14966a9b62f0429650f3b4b41

38/43 >> 88.4%

[cjbi]

Virus:Win32/Ramnit.AF is interesting!
Aggressive infection (Inject thread(s) to all processes) & Virus + Rootkit + Etc!

Interesting string from rootkit.

Code: Select all

c:\project\demetra\loader~1\drivers\ssdt\driver~1\objfre_win7_x86\i386\SdtRestore.pdb

Injected thread(s) memory dump, rootkit memory dump attached.

[rkhunter]

One more Trojan:Win32/Ramnit.A and it's driver.

Dropper:
5/43 >> 11.6%

Installs driver as "Microsoft Windows Service" in registry.
Autostart from Winlogon\Userinit.

Detailed analysis: http://camas.comodo.com/cgi-bin/submit? ... edccedc6fc

[rkhunter]

2 samples of Trojan:Win32/Ramnit with same driver in attach.

15/43 >> 34.9%

14/42 >> 33.3%

Driver:

\Device\631D2408D44C4f47AC647AB96987D4D5
\DosDevices\631D2408D44C4f47AC647AB96987D4D5
systemroot\temp\%x
win32k.sys
\systemroot\system32\win32k.sys
csrss.exe
c:\project\demetra\loader~1\drivers\ssdt\driver~1\objfre_win7_x86\i386\SdtRestore.pdb

[onthar]

2 samples of Trojan:Win32/Ramnit with same driver in attach.

15/43 >> 34.9%

14/42 >> 33.3%

Driver:

\Device\631D2408D44C4f47AC647AB96987D4D5
\DosDevices\631D2408D44C4f47AC647AB96987D4D5
systemroot\temp\%x
win32k.sys
\systemroot\system32\win32k.sys
csrss.exe
c:\project\demetra\loader~1\drivers\ssdt\driver~1\objfre_win7_x86\i386\SdtRestore.pdb

Strange, If I am not mistaken, this version doesn't infect files.

By the way, Xuetr can't manage with this infection. What ARK is best against ramnit?

[kmd]

2 samples of Trojan:Win32/Ramnit with same driver in attach.

By the way, Xuetr can't manage with this infection. What ARK is best against ramnit?

that paylod is damaged. any average ark can wipe original ramnit if u knew where to look.
xuert is Chinese copy-past from several other arks with embedded bsod-generator(TM)

[rkhunter]

Seems this is non-trivial option, how curing itself from file-virus and restart.

[Maxstar]

MD5: c30e096aaf1210052dee20062a962532
https://www.virustotal.com/file/93d87ad ... 326885889/

[rkhunter]

Ramnit with file-infector.

MD5: 87633eb6eeb7edd72ded8e33ef0c2920

8/42

Driver has not changed from December.

[rkhunter]

Trojan:Win32/Ramnit

MD5: B6867BAAA9F0627E0FDA773BCDF90BA3
6/43