Ramnit
Aliases: Nimnul
- First seen
- 2010-01-01 00:00:00
- Malware type
- trojan, credential-stealer
- Family
- Malware family
- Last IoC activity
- 2026-07-22 02:23:33
- Profile updated
- 2026-07-07 12:53:53
Targeted industries: financial-services
Targeted regions: country_code:gb country_code:it country_code:ca
Context
According to Check Point, Ramnit is primarily a banking trojan, meaning that its purpose is to steal login credentials for online banking, which cybercriminals can sell or use in future attacks. For this reason, Ramnit primarily targets individuals rather than focusing on particular industries. Ramnit campaigns have been observed to target organizations in particular industries. For example, a 2019 campaign targeted financial organizations in the United Kingdom, Italy, and Canada.
Detection coverage
- 2 YARA rules
Detection rules
- CAPE_Ramnit (yara-rule)
- MALPEDIA_Win_Ramnit_Auto (yara-rule)
Related threat objects
- Ramnit (infrastructure)
Reports & references
- pwc.co.uk — Cyber Threats 2019 Retrospect (report)
- secureworks.com — Gold Fairfax (report)
- ibm.ent.box.com — Hs5Pcayhbbhjvj8Di5Sqdpbbd88Tsh89 (report)
- research.checkpoint.com — Graphology Of An Exploit Playbit (report)
- gallery.mailchimp.com — Csis Threat Matrix H1 2019 (report)
- f5.com — Banking Trojans A Reference Guide To The Malware Family Tree (report)
- Kaspersky — 101638 (report)
- securityintelligence.com — From Ramnit To Bumblebee Via Neverquest (report)
- Mandiant — Pe File Infecting Malware Ot (report)
- youtube.com — Watch (report)
- redcanary.com — Deep Dive Process Injection (report)
- research.checkpoint.com — Ramnits Network Proxy Servers (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Ramnit (report)
- cert.pl — Ramnit In Depth Analysis (report)
- contagiodump.blogspot.com — Blackhole Ramnit Samples And Analysis (report)
- researchgate.net — Botnet Protocol Inference In The Presence Of Encrypted Traffic (report)
- nao-sec.org — Analyzing Ramnit Used In Seamless (report)
- vkremez.com — Deeper Dive Into Ramnit Banker Vnc Ifsb (report)
- bin.re — The Dga Of Ramnit (report)
- informationsecurity.report — B201D876 C5Df 486D 975E 2Dc08Eb85F02 W32.Ramnit%20Analysis (report)
- securityintelligence.com — Ramnit Banking Trojan Stealing Card Data (report)
- blogs.akamai.com — Ramnit In The Uk (report)
- artik.blue — Malware4 (report)
- Broadcom/Symantec — W32 Ramnit Analysis 15 En (report)
- malwarebreakdown.com — The Seamless Campaign Isnt Losing Any Steam (report)