ramsay | d568230d6b18b4701f9fef4370e98756e7934e71699078da451177df3393a59e

General

Target
2026-10-07_3e6660c89611192637e1f71b94bab3e2_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 2.5MB
Sample261008-rtf1lsz12q
SHA256 d568230d6b18b4701f9fef4370e98756e7934e71699078da451177df3393a59e
MD5 3e6660c89611192637e1f71b94bab3e2
SHA1 317319f19ee0490a0aa2eee0e9d609d0e37c1181
SHA512 c54b8fac24f2ea8e7d08d123d2ccd79a34ef110352c8ec607267f9cccab357f810530fe442cd3d2ae3064f5bfb99222537f06561d9360d4c70f8fbee4eb8b284
SSDEEP 49152:Ph/oBdqTDtSQWGt5FbTChxKCnFnQXBbrtgb/iQvu0UHOf:ZoqTB3zF6hxvWbrtUTrUHOf
TLSH
T15DC5F0112390CC21F36FC13287E59E75B63769223B73C88A6E8814751BF1E9FDBA1256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_3e6660c89611192637e1f71b94bab3e2_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.5MB
- SHA256 d568230d6b18b4701f9fef4370e98756e7934e71699078da451177df3393a59e
- MD5 3e6660c89611192637e1f71b94bab3e2
- SHA1 317319f19ee0490a0aa2eee0e9d609d0e37c1181
- SHA512 c54b8fac24f2ea8e7d08d123d2ccd79a34ef110352c8ec607267f9cccab357f810530fe442cd3d2ae3064f5bfb99222537f06561d9360d4c70f8fbee4eb8b284
- SSDEEP 49152:Ph/oBdqTDtSQWGt5FbTChxKCnFnQXBbrtgb/iQvu0UHOf:ZoqTB3zF6hxvWbrtUTrUHOf
- TLSH
  T15DC5F0112390CC21F36FC13287E59E75B63769223B73C88A6E8814751BF1E9FDBA1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework persistence rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2