ramsay | 3f848aeb4c0d2ff3edf0cbcb963ca2b0740c88bf0fd598ad6d5f4cf0929c659d

General

Target
2026-10-19_d7d2b442d70d38da6c6029189285b58f_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
Size 2.5MB
Sample261019-vmtvnsgf55
SHA256 3f848aeb4c0d2ff3edf0cbcb963ca2b0740c88bf0fd598ad6d5f4cf0929c659d
MD5 d7d2b442d70d38da6c6029189285b58f
SHA1 7dc06b36317381ddc9ab36201b96888064bd018e
SHA512 436def4b90956bb1a68426556e41dfde8fd7f366db2e870fc7e9343605416d7036bc271a763f59d208756b0903d37cbe4d127efd00126d665234d8d15297e5fe
SSDEEP 49152:bh1oBdqTDtSQWGtbRbTChxKCnFnQXBbrtgb/iQvu0UHOn:/oqTB3FR6hxvWbrtUTrUHOn
TLSH
T15AC5F0112390CC61F36FC13243E5AE75B63769213B73C88A6E8814751BF1E9FEBA1256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-19_d7d2b442d70d38da6c6029189285b58f_amadey_coinminer_darkgate_darpapox_elex_manuscrypt_nymaim_rhadamanthys_smoke-loader_stealc_stop_wannacry
- Size 2.5MB
- SHA256 3f848aeb4c0d2ff3edf0cbcb963ca2b0740c88bf0fd598ad6d5f4cf0929c659d
- MD5 d7d2b442d70d38da6c6029189285b58f
- SHA1 7dc06b36317381ddc9ab36201b96888064bd018e
- SHA512 436def4b90956bb1a68426556e41dfde8fd7f366db2e870fc7e9343605416d7036bc271a763f59d208756b0903d37cbe4d127efd00126d665234d8d15297e5fe
- SSDEEP 49152:bh1oBdqTDtSQWGtbRbTChxKCnFnQXBbrtgb/iQvu0UHOn:/oqTB3FR6hxvWbrtUTrUHOn
- TLSH
  T15AC5F0112390CC61F36FC13243E5AE75B63769213B73C88A6E8814751BF1E9FEBA1256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework persistence rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2