Ramnit

Ramnit is a long-running Windows banking trojan and malware family that has also been described in some reporting as a file-infector-capable threat. It is primarily associated with theft of online banking credentials and other authentication data entered through web browsers. Ramnit has been observed performing information theft and exfiltration, capturing screenshots, and executing additional files or payloads on compromised systems. Its role in criminal operations has evolved over time, with some activity indicating use not only for banking fraud but also as a loader or second-stage delivery component in broader intrusion chains.

Ramnit has been distributed through multiple delivery ecosystems. Documented infection vectors include phishing campaigns using archive files and disguised shortcut files that trigger PowerShell-based downloaders, malvertising campaigns, and exploit-kit-driven delivery. It has been delivered by intermediary malware such as sLoad and has also appeared as a payload delivered by Bedep in exploit-kit activity. These distribution patterns place Ramnit within multi-stage criminal infection chains that rely on social engineering, scripted downloaders, and browser exploitation.

Operationally, Ramnit targets Windows endpoints and focuses heavily on financial theft. Reported capabilities include stealing banking-related information, collecting authentication material from browsers, taking screenshots, and executing follow-on components. Ramnit has also been referenced alongside hidden VNC-enabled banking malware tradecraft used for interactive fraud, although HVNC use should not be generalized as a core capability without case-specific confirmation. Industry reporting has further noted that, like several legacy banking trojans, some Ramnit activity shifted over time toward enabling second-stage attacks rather than exclusively conducting direct banking fraud.