ramsay | 445256589739c74233ceef02fcd66892e89eb153de165bcafd767d9a1cbfa8b8

General

Target
2026-10-07_a92a3e0a79f7de438fb288d7d37b8413_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 2.5MB
Sample261008-jl9c7adv2l
SHA256 445256589739c74233ceef02fcd66892e89eb153de165bcafd767d9a1cbfa8b8
MD5 a92a3e0a79f7de438fb288d7d37b8413
SHA1 dbfbca5b7eaaa60b754c56afa1ace59d159546d5
SHA512 37ccd149376826cf7aa34fea79853a48f94fa9451473ac858b1fbeeea55bfcc32333d10637a79a8e91d550bee32a04619b93df148b4162b4660a36d3cbcf1180
SSDEEP 49152:Ph/oBdqTDtSQWGt95bTChxKCnFnQXBbrtgb/iQvu0UHOK:ZoqTB3356hxvWbrtUTrUHOK
TLSH
T1E2C5F0112390CC21F36FC13287E59E75B63769223B73C88A6E8814751BF1E9FDBA1256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_a92a3e0a79f7de438fb288d7d37b8413_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.5MB
- SHA256 445256589739c74233ceef02fcd66892e89eb153de165bcafd767d9a1cbfa8b8
- MD5 a92a3e0a79f7de438fb288d7d37b8413
- SHA1 dbfbca5b7eaaa60b754c56afa1ace59d159546d5
- SHA512 37ccd149376826cf7aa34fea79853a48f94fa9451473ac858b1fbeeea55bfcc32333d10637a79a8e91d550bee32a04619b93df148b4162b4660a36d3cbcf1180
- SSDEEP 49152:Ph/oBdqTDtSQWGt95bTChxKCnFnQXBbrtgb/iQvu0UHOK:ZoqTB3356hxvWbrtUTrUHOK
- TLSH
  T1E2C5F0112390CC21F36FC13287E59E75B63769223B73C88A6E8814751BF1E9FDBA1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework persistence rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2