ramsay | ce81a11e36168d5ff0e8ceb02b95194343b5f090b15bc8f0e3c3b488757fefaa

General

Target
2026-10-07_32fe5ec97b230a8e4468c3786edb069e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 2.3MB
Sample261008-spdv5aat4z
SHA256 ce81a11e36168d5ff0e8ceb02b95194343b5f090b15bc8f0e3c3b488757fefaa
MD5 32fe5ec97b230a8e4468c3786edb069e
SHA1 97a5b13ea52800e777a22ee175efb3b24bab917b
SHA512 a4928da99b6a47f9c85fd6d5551ba54df797c7a4e253a6575e0202910c844cb753f20e3880c4a99dd8c2ddf5e5bedb4f564d357404d9e307df1031a03f06c368
SSDEEP 49152:th3oBdqTDtSQWGtxzZyqBjaPOfpdvLRrLL8D02tqBcGs8psWWQ:HoqTB3fz7hagdvVrf8D02UlpsWWQ
TLSH
T14DB5232135E48072E2531530CAED9BB1A6AFFF1A5F3444CB6BC45B1E1E31AD4DA3871A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-07_32fe5ec97b230a8e4468c3786edb069e_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.3MB
- SHA256 ce81a11e36168d5ff0e8ceb02b95194343b5f090b15bc8f0e3c3b488757fefaa
- MD5 32fe5ec97b230a8e4468c3786edb069e
- SHA1 97a5b13ea52800e777a22ee175efb3b24bab917b
- SHA512 a4928da99b6a47f9c85fd6d5551ba54df797c7a4e253a6575e0202910c844cb753f20e3880c4a99dd8c2ddf5e5bedb4f564d357404d9e307df1031a03f06c368
- SSDEEP 49152:th3oBdqTDtSQWGtxzZyqBjaPOfpdvLRrLL8D02tqBcGs8psWWQ:HoqTB3fz7hagdvVrf8D02UlpsWWQ
- TLSH
  T14DB5232135E48072E2531530CAED9BB1A6AFFF1A5F3444CB6BC45B1E1E31AD4DA3871A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2