ramsay | af42357b41eda180fc8fbf8e0b2e1fb3d283b871fb63520cfc79d8061948cf83

General

Target
2026-10-09_974c650ab3dd180851f06e062e2ada99_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 3.4MB
Sample261010-j61a1sav5k
SHA256 af42357b41eda180fc8fbf8e0b2e1fb3d283b871fb63520cfc79d8061948cf83
MD5 974c650ab3dd180851f06e062e2ada99
SHA1 0c89fd88b57363a8cb26c2dbe5731213b2ee3e54
SHA512 82706f5556f0d5e62197441e863befc78c0d7007e0403d5e1a508ef12615b3e515d0a0d5e8f07ce30792de042d6860f71c08595801d97b8c65d323864732805b
SSDEEP 49152:1hLoBdqTDtSQWGtaQak5DoTQxlmIXy0CxHCmcnO3t1Jidk8UQ4cnO3t1Jidk8UQm:zoqTB3Mpk5MEfgCmc+DwEc+Dwa
TLSH
T1FFF53311B7C8D072F2BD71348A648B589E2AB4122FD481D777E8072F0D61BE4AE3675B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-09_974c650ab3dd180851f06e062e2ada99_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 3.4MB
- SHA256 af42357b41eda180fc8fbf8e0b2e1fb3d283b871fb63520cfc79d8061948cf83
- MD5 974c650ab3dd180851f06e062e2ada99
- SHA1 0c89fd88b57363a8cb26c2dbe5731213b2ee3e54
- SHA512 82706f5556f0d5e62197441e863befc78c0d7007e0403d5e1a508ef12615b3e515d0a0d5e8f07ce30792de042d6860f71c08595801d97b8c65d323864732805b
- SSDEEP 49152:1hLoBdqTDtSQWGtaQak5DoTQxlmIXy0CxHCmcnO3t1Jidk8UQ4cnO3t1Jidk8UQm:zoqTB3Mpk5MEfgCmc+DwEc+Dwa
- TLSH
  T1FFF53311B7C8D072F2BD71348A648B589E2AB4122FD481D777E8072F0D61BE4AE3675B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2