ramsay | 429b2b7de3ee9323839608dfc2cffaa40d60ab8157001007c7ac7098ffe18ab7

General

Target
2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 740KB
Sample261012-3ehrfafb82
SHA256 429b2b7de3ee9323839608dfc2cffaa40d60ab8157001007c7ac7098ffe18ab7
MD5 41831600d1c420d9a14442173827a802
SHA1 32c5cc12108e9e776fa39b535655af75519e8f2a
SHA512 4218d3862e1b03fadf691b15d00ae57776882aed871289ef2a955b5e30b3659e7f0f25167159b78cc5ac848926810da835ab66ffbe64cc0edd494cd39dc23b85
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxISPJ:1hLalj3DSudvGM3MXTVhtSQWGtxlPJ
TLSH
T1D1F40221B1948072F06351308AB9DB728B2EBD525BB490DFA78885BE1E716E4DF3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_41831600d1c420d9a14442173827a802_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 740KB
- SHA256 429b2b7de3ee9323839608dfc2cffaa40d60ab8157001007c7ac7098ffe18ab7
- MD5 41831600d1c420d9a14442173827a802
- SHA1 32c5cc12108e9e776fa39b535655af75519e8f2a
- SHA512 4218d3862e1b03fadf691b15d00ae57776882aed871289ef2a955b5e30b3659e7f0f25167159b78cc5ac848926810da835ab66ffbe64cc0edd494cd39dc23b85
- SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxISPJ:1hLalj3DSudvGM3MXTVhtSQWGtxlPJ
- TLSH
  T1D1F40221B1948072F06351308AB9DB728B2EBD525BB490DFA78885BE1E716E4DF3435B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2