ramsay | 0fc8b68eca417d2e9d1c283390929f5957d8af9e0a12767f5b3efb2482ded580

General

Target
2026-10-11_a34a12df3959842241ac42f85bd0c90a_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 758KB
Sample261012-rn2p5abs9x
SHA256 0fc8b68eca417d2e9d1c283390929f5957d8af9e0a12767f5b3efb2482ded580
MD5 a34a12df3959842241ac42f85bd0c90a
SHA1 d2a62563cc976dc792e25a8ce0d7f2dcf6620fc1
SHA512 437eb4d651d33a6e228401619dbcc7a3d91d7cd1dc2bc61daae3c1b452ebe3b054451843b80043575e3c9b9bbd397d852620e52e5895d739c2dca24a8c8ddba9
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxaEw:1hLalj3DSudvGM3MXTVhtSQWGtxaEw
TLSH
T179F40121B1E08036F07351314A69C7719B2FBE625BA890CB778C09AE1F61AE5DF3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_a34a12df3959842241ac42f85bd0c90a_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 758KB
- SHA256 0fc8b68eca417d2e9d1c283390929f5957d8af9e0a12767f5b3efb2482ded580
- MD5 a34a12df3959842241ac42f85bd0c90a
- SHA1 d2a62563cc976dc792e25a8ce0d7f2dcf6620fc1
- SHA512 437eb4d651d33a6e228401619dbcc7a3d91d7cd1dc2bc61daae3c1b452ebe3b054451843b80043575e3c9b9bbd397d852620e52e5895d739c2dca24a8c8ddba9
- SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxaEw:1hLalj3DSudvGM3MXTVhtSQWGtxaEw
- TLSH
  T179F40121B1E08036F07351314A69C7719B2FBE625BA890CB778C09AE1F61AE5DF3535B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2