ramsay | d3aa1d38e96f7a152d9aace75e9bb3fd469a08fff89e5f4381e317879aa116d1

General

Target
2026-10-11_01754aa70482a8a31b9e0599df8fc217_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 920KB
Sample261013-gh63jsgt4v
SHA256 d3aa1d38e96f7a152d9aace75e9bb3fd469a08fff89e5f4381e317879aa116d1
MD5 01754aa70482a8a31b9e0599df8fc217
SHA1 764303d8d7bc5f125b71240f0e25f12fbb8275f6
SHA512 55dd69b0333dbf2c7c77fe80cacab5e59c06cd0e953bc351f76acf2e6596d72ab6104fe212ce9f7ad0d395c60586c493666df7473a030ac6f7d84c5811c7ef07
SSDEEP 24576:Bh0alj3DSudvGM3MXTVhtSQWGtx7QOLKsMvW:Bh0oBdqTDtSQWGt3LZ
TLSH
T11715F120B5A08432D4D200B0CF658B66DF69B55A0F2890D777CC169D2F629FAE73E367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-11_01754aa70482a8a31b9e0599df8fc217_amadey_coinminer_darkgate_elex_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 920KB
- SHA256 d3aa1d38e96f7a152d9aace75e9bb3fd469a08fff89e5f4381e317879aa116d1
- MD5 01754aa70482a8a31b9e0599df8fc217
- SHA1 764303d8d7bc5f125b71240f0e25f12fbb8275f6
- SHA512 55dd69b0333dbf2c7c77fe80cacab5e59c06cd0e953bc351f76acf2e6596d72ab6104fe212ce9f7ad0d395c60586c493666df7473a030ac6f7d84c5811c7ef07
- SSDEEP 24576:Bh0alj3DSudvGM3MXTVhtSQWGtx7QOLKsMvW:Bh0oBdqTDtSQWGt3LZ
- TLSH
  T11715F120B5A08432D4D200B0CF658B66DF69B55A0F2890D777CC169D2F629FAE73E367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2