ramsay | aad3aed2baf872f552c7160a611f1bafb0e88caee65f708a28b4a40d1642ae2c

General

Target
2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.3MB
Sample261012-vacevseb64
SHA256 aad3aed2baf872f552c7160a611f1bafb0e88caee65f708a28b4a40d1642ae2c
MD5 89a62a1af3fa21ead9a1e06e59f181dd
SHA1 0de6b0b929074b121a9f1d7ac395ae4a67838e9a
SHA512 f6eab62ce28e14e40a8a11c974b3c2c7d9a15533e72d2248b16fd8c054bee1147b4d91793ce66ad7347b65163567009a75ee22cd6252762a716443fb5ceff0f0
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxLQVczvJ8XT2P6L0bk0WwNJK:1hLoBdqTDtSQWGtVQaR8ek0RLJK
TLSH
T11355231176D58032E0A662308AACDBA28E7EBD515BB4D1CB77C805AA1D71BE5DF3430F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_89a62a1af3fa21ead9a1e06e59f181dd_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.3MB
- SHA256 aad3aed2baf872f552c7160a611f1bafb0e88caee65f708a28b4a40d1642ae2c
- MD5 89a62a1af3fa21ead9a1e06e59f181dd
- SHA1 0de6b0b929074b121a9f1d7ac395ae4a67838e9a
- SHA512 f6eab62ce28e14e40a8a11c974b3c2c7d9a15533e72d2248b16fd8c054bee1147b4d91793ce66ad7347b65163567009a75ee22cd6252762a716443fb5ceff0f0
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtxLQVczvJ8XT2P6L0bk0WwNJK:1hLoBdqTDtSQWGtVQaR8ek0RLJK
- TLSH
  T11355231176D58032E0A662308AACDBA28E7EBD515BB4D1CB77C805AA1D71BE5DF3430F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2