Malware

About “Win32.Ramnit.K” infection

Malware Removal

The Win32.Ramnit.K is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32.Ramnit.K virus can do?

  • Executable code extraction
  • Injection with CreateRemoteThread in a remote process
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Attempts to connect to a dead IP:Port (6 unique times)
  • Starts servers listening on 0.0.0.0:21
  • Expresses interest in specific running processes
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Tries to suspend Cuckoo threads to prevent logging of malicious activity
  • Code injection with CreateRemoteThread in a remote process
  • Tries to unhook or modify Windows functions monitored by Cuckoo
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Anomalous binary characteristics

Related domains:

supnewdmn.com
tvrstrynyvwstrtve.com
rtvwerjyuver.com
wqerveybrstyhcerveantbe.com

How to determine Win32.Ramnit.K?


File Info:

crc32: 919058DB
md5: f7f222a9c328b2515e2dffbe62002e2b
name: F7F222A9C328B2515E2DFFBE62002E2B.mlw
sha1: 39b54fe8a726d7502548356729b7f14793a7c732
sha256: 4f0790556072df8347f13be4fe3068c743b7a7f0dcefa155b434d8c408ec8d35
sha512: 23fbacf6202537c71284b8c102ec39ed82b254cfdee561647317d9ba1189bde5d29151af64db13a45110aad70933a42a72cbc64585088f54ecde342f18b19750
ssdeep: 3072:gJybrq6Einslx76rZtpwL2jbyqj/Vyk1he4zrP/z5oiK2/9gKfpJp/:k6sMjrVPekR1
type: PE32 executable (DLL) (console) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: SQLCECOMPACT30
FileVersion: 3.00.5300.0 built by: SQLCEBLD
CompanyName: Microsoft Corporation
ProductName: Microsoft SQL Server Compact Edition
ProductVersion: 3.00.5300.0
FileDescription: Database Repair Tool
OriginalFilename: SQLCECOMPACT30
Translation: 0x0409 0x04b0

Win32.Ramnit.K also known as:

BkavW32.Tmgrtext.PE
Elasticmalicious (high confidence)
MicroWorld-eScanWin32.Ramnit.K
CAT-QuickHealW32.Ramnit.A
ALYacWin32.Ramnit.K
CylanceUnsafe
ZillyaVirus.Nimnul.Win32.1
SangforMalware
K7AntiVirusVirus ( 002fe95d1 )
K7GWVirus ( 002fe95d1 )
CrowdStrikewin/malicious_confidence_100% (D)
ArcabitWin32.Ramnit.K
InvinceaML/PE-A + W32/Ramnit-A
BaiduWin32.Virus.Nimnul.a
CyrenW32/Ramnit.B!Generic
SymantecW32.Ramnit.B!inf
TotalDefenseWin32/Ramnit.DX
APEXMalicious
AvastWin32:RmnDrp [Inf]
ClamAVWin.Trojan.Ramnit-1847
KasperskyVirus.Win32.Nimnul.a
BitDefenderWin32.Ramnit.K
NANO-AntivirusVirus.Win32.Nimnul.bqjjnb
RisingVirus.Mgr!1.9AD0 (CLASSIC)
Ad-AwareWin32.Ramnit.K
EmsisoftWin32.Ramnit.K (B)
ComodoVirus.Win32.Ramnit.K@37eb7u
F-SecureMalware.W32/Ramnit.C
DrWebWin32.Rmnet.12
VIPREVirus.Win32.Ramnit.b (v)
McAfee-GW-EditionBehavesLike.Win32.Ramnit.cc
SophosW32/Ramnit-A
IkarusVirus.Win32.Nimnul
WebrootW32.Ramnit.Gen
AviraW32/Ramnit.C
MAXmalware (ai score=89)
Antiy-AVLVirus/Win32.Nimnul.a
KingsoftWin32.Ramnit.lx.30720
GridinsoftWorm.Win32.Ramnit.bot!ep-24601
MicrosoftVirus:Win32/Ramnit.J
ViRobotWin32.Nimnul.A
ZoneAlarmVirus.Win32.Nimnul.a
GDataWin32.Virus.Nimnul.A
CynetMalicious (score: 85)
AhnLab-V3Win32/Ramnit.Gen
McAfeeW32/Ramnit.a
VBA32Virus.Win32.Nimnul.b
ZonerTrojan.Win32.Ramnit.22016
ESET-NOD32Win32/Ramnit.A
TencentVirus.Win32.Nimnul.f
SentinelOneStatic AI – Malicious PE
MaxSecureVirus.Nimnul.A
FortinetW32/Ramnit.A
BitDefenderThetaAI:FileInfector.E44F219F0E
AVGWin32:RmnDrp [Inf]
PandaW32/Nimnul.A
Qihoo-360Virus.Win32.Ramnit.A

How to remove Win32.Ramnit.K?

Win32.Ramnit.K removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment