ramsay | c22f8f2c2d9b15e18c048c096c350b6347b3db4b9d80086e20362a4aabb34880

General

Target
2026-09-30_76e2c88329aaa051924a0f07eee689fa_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 2.5MB
Sample261001-n3nv2avvcv
SHA256 c22f8f2c2d9b15e18c048c096c350b6347b3db4b9d80086e20362a4aabb34880
MD5 76e2c88329aaa051924a0f07eee689fa
SHA1 9262ca53666a678d987e5d6aeb2a0ae783c862f1
SHA512 bd3a597ffeacdf294b0ca43c8f43c11a87ebbe3df2cb0970a3c5296907363f9695192daf475c21f726317cea58d7c2f7f896fe8287d8dbe22107090952975398
SSDEEP 49152:bh1oBdqTDtSQWGty9bTChxKCnFnQXBbrtgb/iQvu0UHOm:/oqTB3c96hxvWbrtUTrUHOm
TLSH
T184C5F0112390CC61F36FC13247E5AE75B63769213B33C88A6E8814751BF1E9FEBA1256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-09-30_76e2c88329aaa051924a0f07eee689fa_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.5MB
- SHA256 c22f8f2c2d9b15e18c048c096c350b6347b3db4b9d80086e20362a4aabb34880
- MD5 76e2c88329aaa051924a0f07eee689fa
- SHA1 9262ca53666a678d987e5d6aeb2a0ae783c862f1
- SHA512 bd3a597ffeacdf294b0ca43c8f43c11a87ebbe3df2cb0970a3c5296907363f9695192daf475c21f726317cea58d7c2f7f896fe8287d8dbe22107090952975398
- SSDEEP 49152:bh1oBdqTDtSQWGty9bTChxKCnFnQXBbrtgb/iQvu0UHOm:/oqTB3c96hxvWbrtUTrUHOm
- TLSH
  T184C5F0112390CC61F36FC13247E5AE75B63769213B33C88A6E8814751BF1E9FEBA1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework persistence rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2