Ramnit – in-depth analysis

This report provides a detailed technical analysis of the Ramnit banking trojan, describing its multi-stage packing/unpacking, exploitation of older Windows privilege-escalation CVEs, persistence mechanisms, DGA-driven C2 domain generation and custom RC4/XOR-encrypted C2 protocol, modules enabling cookie theft, Man-in-the-Browser webinjects, and AV-evasion, and supplies IoCs (sample hashes and YARA references) and notes on a new variant observed in spam campaigns.