ramsay | 267c4ce82824f2e586c35a8c52223319e1cc04b96d9f58aa9a00fd10560b875c

General

Target
2026-10-11_34a7e6d09eb9680188097f06af191d58_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.4MB
Sample261013-a2bx7agf99
SHA256 267c4ce82824f2e586c35a8c52223319e1cc04b96d9f58aa9a00fd10560b875c
MD5 34a7e6d09eb9680188097f06af191d58
SHA1 b4033d6ff4a7b736c767ddd9cb0cfc37c46062e7
SHA512 c3c03f42bffc26148a93a5faf15451ec8295c14a008d2363f7e87c13243bbfe7df55a742275df34ac4e2c0cc4422953eee5b60c661c08e091fd7fbc934d0d132
SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx1a4P8UyLGVfGv:1hLoBdqTDtSQWGt3bfyiYv
TLSH
T1C865AE11B841C6EBC0A1BEB50EE58B53B3353D42DE015A07B297734F7DFA2D2DA1A918
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_34a7e6d09eb9680188097f06af191d58_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.4MB
- SHA256 267c4ce82824f2e586c35a8c52223319e1cc04b96d9f58aa9a00fd10560b875c
- MD5 34a7e6d09eb9680188097f06af191d58
- SHA1 b4033d6ff4a7b736c767ddd9cb0cfc37c46062e7
- SHA512 c3c03f42bffc26148a93a5faf15451ec8295c14a008d2363f7e87c13243bbfe7df55a742275df34ac4e2c0cc4422953eee5b60c661c08e091fd7fbc934d0d132
- SSDEEP 24576:1hLalj3DSudvGM3MXTVhtSQWGtx1a4P8UyLGVfGv:1hLoBdqTDtSQWGt3bfyiYv
- TLSH
  T1C865AE11B841C6EBC0A1BEB50EE58B53B3353D42DE015A07B297734F7DFA2D2DA1A918
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2