ramsay | 0feb6e78da313e452c4e51959adb92d8dfff0342d47200f26481d6bd8ab19a8f

General

Target
2026-10-11_3b2f91ebd440f60e39f3645af2773e0c_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.4MB
Sample261012-31g22acy3k
SHA256 0feb6e78da313e452c4e51959adb92d8dfff0342d47200f26481d6bd8ab19a8f
MD5 3b2f91ebd440f60e39f3645af2773e0c
SHA1 ee325e4ece877e97eae09ab1d7214b43db2473c2
SHA512 efe8da5676504fe33d01095601171bc87f023bb00a55b60ca8bb3971dc73bdc97eab97a33659b4722f3c552771636ec3e35ae08636bbf3592c6b77181f04423e
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxFvTmYeGEMbO5Dn0jdn2YMjpcm4iPVnp0oywMI:1hLoBdqTDtSQWGtPTmYeGEMjnGum4UQI
TLSH
T10165CF2167888831F7F3217145786270867DBE200B71D9CB976085AE6E76EC29E353EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_3b2f91ebd440f60e39f3645af2773e0c_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.4MB
- SHA256 0feb6e78da313e452c4e51959adb92d8dfff0342d47200f26481d6bd8ab19a8f
- MD5 3b2f91ebd440f60e39f3645af2773e0c
- SHA1 ee325e4ece877e97eae09ab1d7214b43db2473c2
- SHA512 efe8da5676504fe33d01095601171bc87f023bb00a55b60ca8bb3971dc73bdc97eab97a33659b4722f3c552771636ec3e35ae08636bbf3592c6b77181f04423e
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxFvTmYeGEMbO5Dn0jdn2YMjpcm4iPVnp0oywMI:1hLoBdqTDtSQWGtPTmYeGEMjnGum4UQI
- TLSH
  T10165CF2167888831F7F3217145786270867DBE200B71D9CB976085AE6E76EC29E353EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2