ramsay | a668ebbb215e83d18b3510ffcc85b0cccdb8dc9f2cb5410e9273adac84434c27

General

Target
2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.6MB
Sample260928-v3dhmaca58
SHA256 a668ebbb215e83d18b3510ffcc85b0cccdb8dc9f2cb5410e9273adac84434c27
MD5 2171c956396c16f825f48c3b358e4249
SHA1 d3a7dd7fcea7dec5b08623c6e177379d1c8114b8
SHA512 eed00ff6ff319c6e2a88acbd4c11297a8ee3bb339fe6ff34e93703eed7dad5b66aa9aee72010a544a957c7546c371681bd80a0ea3648095a991fced85b224f2d
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx8EMWOX6jKvSM4Smw+bI0YLoOQ2xiAn5Vqkir:1hLoBdqTDtSQWGtG3RVaxrbIRoWiA5o7
TLSH
T1C485AE10FB87A0F2E92301704996E3BB9330F611C425DEB7FB9D5B5EF923552293621A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-28_2171c956396c16f825f48c3b358e4249_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.6MB
- SHA256 a668ebbb215e83d18b3510ffcc85b0cccdb8dc9f2cb5410e9273adac84434c27
- MD5 2171c956396c16f825f48c3b358e4249
- SHA1 d3a7dd7fcea7dec5b08623c6e177379d1c8114b8
- SHA512 eed00ff6ff319c6e2a88acbd4c11297a8ee3bb339fe6ff34e93703eed7dad5b66aa9aee72010a544a957c7546c371681bd80a0ea3648095a991fced85b224f2d
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx8EMWOX6jKvSM4Smw+bI0YLoOQ2xiAn5Vqkir:1hLoBdqTDtSQWGtG3RVaxrbIRoWiA5o7
- TLSH
  T1C485AE10FB87A0F2E92301704996E3BB9330F611C425DEB7FB9D5B5EF923552293621A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2