Loading story…
Researchers documented Ramnit as a Zeus-like banking trojan, worm, and file infector that was distributed through the Blackhole exploit kit and equipped with rootkit capabilities, spam-sending functions, and aggressive persistence. Analysis of multiple samples showed the malware dropping several components, installing a fake "Mi cor soft Windows Service", injecting into svchost.exe, and in some cases infecting executable and HTML files by appending malicious code. One sample was tied more closely to botnet and spam activity, while another emphasized file infection, a combination that made reliable cleanup difficult and led researchers to recommend full system rebuilds rather than partial remediation.
The reporting also showed that Ramnit used resilient command-and-control methods, including communications over port 443 with a custom encoded protocol rather than SSL and large fallback domain lists to find active servers. Separate reverse engineering of the malware's domain generation algorithm (DGA) found that Ramnit generated variable-length .com domains using a simple linear congruential generator and multiple observed 32-bit seeds, including 0xEF214BBF, 0x28488EEA, 0x4BFCBC6A, and 0x79159C10. Investigators linked parts of the infrastructure to pharma spam operations, noted overlap with previously documented Ramnit C2 servers, and reported that while one command server had been sinkholed, other infrastructure remained active.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
A technical analysis reverse engineered Ramnit's domain generation algorithm, showing it used a linear congruential generator to create .com domains with 8 to 19 character second-level names. The report also published Python code to reproduce the DGA and identified multiple seeds observed in the wild.
Reverse-engineering reported that Ramnit DGA seed 0x79159C10 was first used in April 2014. Samples using this seed were later observed on Malwr, VirusTotal, and in Sophos detections.
Reverse-engineering indicated that Ramnit DGA seed 0x4BFCBC6A probably first appeared in early 2013. Sophos associated several Ramnit variants, including Ramnit-B and Ramnit-FS, with this seed.
Later reverse-engineering reported that Ramnit samples associated with DGA seed 0x28488EEA were first used in March 2012. Samples tied to this seed were seen on Malwr, SonicWall, Sophos, and Lavasoft.
Analysis documented Ramnit samples being distributed through the Blackhole exploit kit rather than Facebook-themed lures. The report detailed persistence, rootkit behavior, spam activity, file infection, and command-and-control infrastructure, noting one C2 had been sinkholed while another remained active.
A VirusTotal submission for the infected file VirusTotalUpload2.exe showed 37 of 43 antivirus engines detecting it. The sample was identified with MD5 25f6ee42d37e3f2f7dbe795e836d52e2.
Ramnit was first seen as a Zeus-like malware family used to spy on infected users. Later analysis described it as combining trojan, worm, file-infector, and rootkit capabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed how the **Seamless** drive-by download campaign delivered the **Ramnit** banking trojan after filtering victims by time zone and geolocation, then redirecting selected targets to a **RIG Exploit Kit** landing page. The malware used a custom command-and-control protocol over TCP port `443` that mimicked secure traffic but was **not HTTPS**, with RC4-encrypted data chunks reportedly decodable using a stable key observed in the analyzed environment. The analysis found that Ramnit registered infected hosts by sending two MD5 values to its command server before retrieving region-specific modules and web-inject configurations. Japan-focused infections received localized credit-card-themed web injects, while downloaded components supported antivirus interference, cookie theft, browser injection, and browser communication hooks; U.S.-targeted infections used a similar module set but could also fetch tools such as an FTP grabber and **AZORult**.
Aug 15, 2026
Check Point Research reported that the **Ramnit** malware was used as a loader in a large botnet campaign that infected roughly **100,000 systems in two months** and ultimately delivered **Ngioweb** to more than **139,000 computers**. The operation, dubbed the **"Black" botnet**, repeatedly downloaded Ngioweb from Ramnit command-and-control infrastructure at `185.44.75.109`, then used the secondary malware to create a two-stage command-and-control architecture for **back-connect** and **relay proxy** services. Researchers said the malware was designed to build a large, multi-purpose proxy network capable of reaching remote and internal resources while masking attacker activity by chaining traffic through compromised hosts. Ngioweb maintained persistence through **Startup folders**, **Run registry keys**, and **scheduled tasks**, and used **process hollowing** into `msiexec.exe` along with layered encryption, API and string obfuscation, and sandbox-evasion logic that served fake configuration data in analyst environments.
Aug 14, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026