ramsay | ec4f623a492941845250253b002c97be9d60aea7a7799c0226bb637b7b31e5e3

General

Target
2026-10-07_76315101b3a9eecd24f6b87103389444_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 1.6MB
Sample261008-mvbp3ae121
SHA256 ec4f623a492941845250253b002c97be9d60aea7a7799c0226bb637b7b31e5e3
MD5 76315101b3a9eecd24f6b87103389444
SHA1 8d1500e0618b707b9f0a141d4930903b5fcbe013
SHA512 9e3a072e8c38cca9ec73dea86be1fe704ef994ac1e0c35e5b352f8f3625f12514f65d85672d49a2059ca908a589a42a4cd0b309dc5d18e38158d8c0e53ab206b
SSDEEP 49152:th3oBdqTDtSQWGtxzZyqBS6mYnK1g988zO:HoqTB3fz7fn6x
TLSH
T16375122135E5C077E15325308AED9BF1A5AAFE464F3444CB27C84B2E2E32AD6D73471A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_76315101b3a9eecd24f6b87103389444_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 1.6MB
- SHA256 ec4f623a492941845250253b002c97be9d60aea7a7799c0226bb637b7b31e5e3
- MD5 76315101b3a9eecd24f6b87103389444
- SHA1 8d1500e0618b707b9f0a141d4930903b5fcbe013
- SHA512 9e3a072e8c38cca9ec73dea86be1fe704ef994ac1e0c35e5b352f8f3625f12514f65d85672d49a2059ca908a589a42a4cd0b309dc5d18e38158d8c0e53ab206b
- SSDEEP 49152:th3oBdqTDtSQWGtxzZyqBS6mYnK1g988zO:HoqTB3fz7fn6x
- TLSH
  T16375122135E5C077E15325308AED9BF1A5AAFE464F3444CB27C84B2E2E32AD6D73471A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2