Trojan:Win32/Ramnit.A malicious file

Malware Removal

The Trojan:Win32/Ramnit.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Trojan:Win32/Ramnit.A virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Unconventionial language used in binary resources: Russian
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Trojan:Win32/Ramnit.A?


File Info:

crc32: 2F945F6E
md5: 06c5e0c49535e961a1cacd20725dc9d1
name: 06C5E0C49535E961A1CACD20725DC9D1.mlw
sha1: 9eb0b0ad7e3cd9118e89e2d18a138c62d691eba5
sha256: 7447a2e91db5ee140727499051da9386748d2f20896cae70bf1c79369d88dbbf
sha512: cba524c038982afcee8184e9f1137d8b4f4320b6d69a87ebc84e82cc1ddc40a42cfb38ae1879a1e39b4319e4bff7d8ecc3969427d6940f98b54a1a5b75f9fad5
ssdeep: 1536:jPwOKeqtUAcuTQBWeHYzrohtfXAMgOYrEP/3Y9ZOagjf5dm7:n/KTu4sfvgOYejjBM7
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Trojan:Win32/Ramnit.A also known as:

BkavW32.AIDetect.malware1
Elasticmalicious (high confidence)
MicroWorld-eScanGen:Heur.VIZ.1
FireEyeGeneric.mg.06c5e0c49535e961
CAT-QuickHealTrojan.Quolko.A
McAfeeArtemis!06C5E0C49535
CylanceUnsafe
VIPRETrojan.Win32.Bamital.i (v)
AegisLabTrojan.Win32.Generic.4!c
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_70% (D)
BitDefenderGen:Heur.VIZ.1
K7GWTrojan ( f1000f011 )
K7AntiVirusTrojan ( f1000f011 )
BitDefenderThetaAI:Packer.5583CFA91F
CyrenW32/A-aa9120d9!Eldorado
SymantecW32.Ramnit.B
ESET-NOD32Win32/Ramnit.A
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Trojan.Agent-1299135
KasperskyHEUR:Trojan.Win32.Generic
AlibabaTrojan:Win32/Ramnit.5b4e95d2
NANO-AntivirusTrojan.Win32.Autoruner.coonfk
RisingVirus.Ramnit!8.4 (CLOUD)
Ad-AwareGen:Heur.VIZ.1
TACHYONBackdoor/W32.IRCNite.185344
SophosML/PE-A + Mal/FakeAV-BW
ComodoTrojWare.Win32.Trojan.XPACK.Gen@2ho5ur
F-SecureTrojan.TR/Crypt.XPACK.Gen
DrWebTrojan.Rmnet.1
ZillyaTrojan.Genome.Win32.163976
TrendMicroTROJ_BAMITAL.SMK
McAfee-GW-EditionBehavesLike.Win32.Generic.lc
EmsisoftGen:Heur.VIZ.1 (B)
IkarusTrojan-Ransom.PornoBlocker
JiangminBackdoor/IRCNite.za
AviraTR/Crypt.XPACK.Gen
Antiy-AVLTrojan[Backdoor]/Win32.IRCNite
KingsoftHeur.SSC.2668161.1216.(kcloud)
MicrosoftTrojan:Win32/Ramnit.A
ArcabitTrojan.VIZ.1
AhnLab-V3Trojan/Win32.FraudPack.R3415
ZoneAlarmHEUR:Trojan.Win32.Generic
GDataGen:Heur.VIZ.1
CynetMalicious (score: 100)
TotalDefenseWin32/Spyeye.C!generic
Acronissuspicious
VBA32Trojan.MTA.01240
ALYacGen:Heur.VIZ.1
MAXmalware (ai score=100)
MalwarebytesMalware.Heuristic.1003
PandaGeneric Malware
TrendMicro-HouseCallTROJ_BAMITAL.SMK
TencentWin32.Virus.Ramnit.Gvl
YandexTrojan.PornoBlocker!SIaqt1FjbcE
SentinelOneStatic AI – Malicious PE
eGambitGeneric.Backdoor
FortinetW32/Corupx.B!tr
WebrootW32.Malware.Heur
AVGWin32:Trojan-gen
Paloaltogeneric.ml
Qihoo-360Win32/Trojan.BO.548

How to remove Trojan:Win32/Ramnit.A?

Trojan:Win32/Ramnit.A removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment