ramsay | b45398cd3bae68a01e5d332e506ea0b2fba1ef20700846b10d0cd370061dd9e0

General

Target
2026-10-30_ac9e88976c2998e17dce4d5c38fd5a97_amadey_coinminer_darkgate_elex_emotet_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
Size 1.1MB
Sample261031-1a3jyazyex
SHA256 b45398cd3bae68a01e5d332e506ea0b2fba1ef20700846b10d0cd370061dd9e0
MD5 ac9e88976c2998e17dce4d5c38fd5a97
SHA1 8815f39e70b0375cb58e52df15a475b313a895cc
SHA512 62feec0a96d978917b3d8839fc76fb34b9cd6102494aa0714167107bbb4aaa6552e6a4ff37cdaf86c2fcd33ba86c387f5626446d1ac980f64a6ea110cfa30afa
SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxsZtLUII8rpXu:1hLalj3DSudvGM3MXTVhtSQWGtxsu8N+
TLSH
T11645F12276E0C073E16311304EF8DBB5AB7AF9514F7185CB67885B2E1E71AD18A3532B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-10-30_ac9e88976c2998e17dce4d5c38fd5a97_amadey_coinminer_darkgate_elex_emotet_manuscrypt_rhadamanthys_smoke-loader_stealc_stop
- Size 1.1MB
- SHA256 b45398cd3bae68a01e5d332e506ea0b2fba1ef20700846b10d0cd370061dd9e0
- MD5 ac9e88976c2998e17dce4d5c38fd5a97
- SHA1 8815f39e70b0375cb58e52df15a475b313a895cc
- SHA512 62feec0a96d978917b3d8839fc76fb34b9cd6102494aa0714167107bbb4aaa6552e6a4ff37cdaf86c2fcd33ba86c387f5626446d1ac980f64a6ea110cfa30afa
- SSDEEP 12288:Cmhj3dUlzn3DSudvsh8Awf3XFaZmBITVJPtSrE37yG2LmxsZtLUII8rpXu:1hLalj3DSudvGM3MXTVhtSQWGtxsu8N+
- TLSH
  T11645F12276E0C073E16311304EF8DBB5AB7AF9514F7185CB67885B2E1E71AD18A3532B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

darkhotel apt discovery execution ramsay framework rootkit spyware upx
- Detects Ramsay payload
  spyware apt darkhotel
- Detects the HideDriver kernel rootkit component of Ramsay
  rootkit apt darkhotel
- Family: Ramsay
  Ramsay is a cyber-espionage framework and spyware that collects documents from air-gapped networks.
  framework spyware ramsay
- Detects Reflective DLL injection artifacts
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- UPX dump on OEP (original entry point)
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2