ramsay | 528ce124f579fb0e1f70b3cf519d05abf8ac9419658b9c9fc8f738413773e436

General

Target
2026-09-28_6ca7ee100322be3ec55164ab44daa39d_amadey_coinminer_darkgate_elex_graphican_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 6.1MB
Sample260928-sfbpeabd56
SHA256 528ce124f579fb0e1f70b3cf519d05abf8ac9419658b9c9fc8f738413773e436
MD5 6ca7ee100322be3ec55164ab44daa39d
SHA1 fb4e9eb5120bd040ce002f3101b2739ea159c7b2
SHA512 258251153f6fde2c341d0f32cc6d0997d9ccaac157b8e5e068ce75ad55f2074a4b849f280dcb98f07a4e14852b81f679477a887c542faf837e4e5030ee5a6874
SSDEEP 98304:ooqTB3aT9AMky2NoMF2g0DwoijG9FxVN4YXaVOX1LOw7HD7:42L1HMF2ZDwoisxVN4YKVOX1LnHf
TLSH
T1CA56CF0AE7E38320DD81E9752FBC723B8E754F1292E74ED79464AECD2163687C03951A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-28_6ca7ee100322be3ec55164ab44daa39d_amadey_coinminer_darkgate_elex_graphican_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 6.1MB
- SHA256 528ce124f579fb0e1f70b3cf519d05abf8ac9419658b9c9fc8f738413773e436
- MD5 6ca7ee100322be3ec55164ab44daa39d
- SHA1 fb4e9eb5120bd040ce002f3101b2739ea159c7b2
- SHA512 258251153f6fde2c341d0f32cc6d0997d9ccaac157b8e5e068ce75ad55f2074a4b849f280dcb98f07a4e14852b81f679477a887c542faf837e4e5030ee5a6874
- SSDEEP 98304:ooqTB3aT9AMky2NoMF2g0DwoijG9FxVN4YXaVOX1LOw7HD7:42L1HMF2ZDwoisxVN4YKVOX1LnHf
- TLSH
  T1CA56CF0AE7E38320DD81E9752FBC723B8E754F1292E74ED79464AECD2163687C03951A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2