ramsay | 22bdd9b088107bd8e765c61fda80365e7e243c5e1d8a4a9de407536619fa239f

General

Target
2026-10-05_17fa8629a17cf3d3638d0f781190b5ef_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 20.5MB
Sample261007-gd6wzsszhs
SHA256 22bdd9b088107bd8e765c61fda80365e7e243c5e1d8a4a9de407536619fa239f
MD5 17fa8629a17cf3d3638d0f781190b5ef
SHA1 3f75000d4c60807668d4ca4edb2a9501a389b6f1
SHA512 5430fc7a6706e6435ca87a4bda570b653e93d253772abdd1056a3f6b2f967bc45979ebf6dff5bc537a89770e422a33c60aaa2483f5daed15e75c2136c119359d
SSDEEP 196608:j6l3weBEHmjHX8n9cmqT4ppOw2sq7dwmyvkdoqeJRh8bygebEXm3Bxwth5gbT7I+:dsmaV7cvk9C045augJbaxS0d
TLSH
T1E8275BC9EE8B62F0EAE725F54157E37F4720A606C421DEF6FF886769FA332121415206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-05_17fa8629a17cf3d3638d0f781190b5ef_amadey_coinminer_darkgate_elex_glassworm_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 20.5MB
- SHA256 22bdd9b088107bd8e765c61fda80365e7e243c5e1d8a4a9de407536619fa239f
- MD5 17fa8629a17cf3d3638d0f781190b5ef
- SHA1 3f75000d4c60807668d4ca4edb2a9501a389b6f1
- SHA512 5430fc7a6706e6435ca87a4bda570b653e93d253772abdd1056a3f6b2f967bc45979ebf6dff5bc537a89770e422a33c60aaa2483f5daed15e75c2136c119359d
- SSDEEP 196608:j6l3weBEHmjHX8n9cmqT4ppOw2sq7dwmyvkdoqeJRh8bygebEXm3Bxwth5gbT7I+:dsmaV7cvk9C045augJbaxS0d
- TLSH
  T1E8275BC9EE8B62F0EAE725F54157E37F4720A606C421DEF6FF886769FA332121415206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2