Virus:Win32/Ramnit.F

Virus:Win32/Ramnit.F is a detection for a virus that infects Windows executable files and HTML files and attempts to allow backdoor access to the infected computer.

Infects files

Virus:Win32/Ramnit.F also infects HTML document files with .HTML or .HTM extension. The infected HTML files may be detected as Virus:VBS/Ramnit.B.

Drops other malware

When executed, the virus drops a file as "<file_name>Srv.exe" (for example, "mytestSvr.exe"), where <file_name> is the file name of the infected executable. The dropped file is then executed.

 

This file may be detected as Worm:Win32/Ramnit.A.

Allows backdoor access and control

Virus:Win32/Ramnit.F creates a backdoor by connecting to a remote server. Using this backdoor, a remote attacker can instruct an affected computer to download and execute files.

 

The virus creates a default web browser process (which is invisible to users) and injects code to it. The infection and backdoor functionality occurs in the web browser process context, presumably for the purpose of bypassing a firewall.

 

See the description for Worm:Win32/Ramnit.A for more details on how the malware downloads and executes arbitrary files.

 

Analysis by Scott Molenkamp