General
- Target 2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.6MB
- Sample260916-y2143ss1ft
- SHA256 20083f33f536e5385ff6a304986ef762a8f255e1d823aee5e8243fe74fa4cca4
Score
10/10
Malware Config
Targets
-
- Target 2026-09-16_794a25a81797829ff6ccecd1a6285510_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.6MB
- SHA256 20083f33f536e5385ff6a304986ef762a8f255e1d823aee5e8243fe74fa4cca4
Score10/10-
Detects Ramsay payload
-
Detects the HideDriver kernel rootkit component of Ramsay
-
Family: Ramsay
Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
-
Detects Reflective DLL injection artifacts
-
Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
-
UPX dump on OEP (original entry point)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
System Binary Proxy Execution: Verclsid
Adversaries may abuse Verclsid to proxy execution of malicious code.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.