Loading malware…
Ramsay is Windows spyware with document-collection, screen-capture, reconnaissance, and network-propagation capabilities. It collects Microsoft Word documents from local file systems and text documents, Word documents, and spreadsheets from the Internet Explorer cache. Collected files can be compressed and archived using WinRAR. Ramsay can capture screenshots every 30 seconds and when an external removable storage device is connected. It also enumerates running processes using Tasklist and gathers network configuration information, including routing information and ARP tables, using native Windows utilities.
Ramsay has been distributed through spearphishing emails containing malicious attachments, with execution triggered by users opening or running the attached files. Malicious documents can contain embedded Visual Basic scripts and an embedded agent that is extracted during execution. Ramsay has also masqueraded as a JPEG image and a 7-Zip installer.
The malware can deploy components through ImprovedReflectiveDLLInjection and launch embedded components through Windows process-creation and shell-execution APIs. It maintains persistence through scheduled tasks created using the Windows COM API and can hijack outdated application dependencies with malicious DLLs. It can use UACMe for privilege escalation and propagate by infecting portable executable files on network shared drives. Ramsay has also used Base64 encoding for command-and-control traffic.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
安全厂商ESET 近日又披露了该组织新恶意框架Ramsay，Ramsay 框架是疑似专门用于针对隔离网络的恶意代码，主要通过感染正常软件进行传播，同时与常规恶意软件基于网络协议的C2 不同，Ramsay 框架采用的是自定义的文件传输控制指令，当扫描到被带入隔离网络的感染文件，则从文件特定位置读取指令执行。
53 distinct techniques documented for this family, organized by ATT&CK tactic.
[Ramsay](https://attack.mitre.org/software/S0458) can spread itself by infecting other portable executable files on removable drives.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has been distributed through spearphishing emails with malicious attachments.(Citation: Antiy CERT Ramsay April 2020)
Propagation to network shares using scheduled jobs and Windows Management Instrumentation.
[Ramsay](https://attack.mitre.org/software/S0458) can schedule tasks via the Windows COM API to maintain persistence.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has included embedded Visual Basic scripts in malicious documents.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can use Windows API functions such as <code>WriteFile</code>, <code>CloseHandle</code>, and <code>GetCurrentHwProfile</code> during its collection and file storage operations. [Ramsay](https://attack.mitre.org/software/S0458) can execute its embedded components via <code>CreateProcessA</code> and <code>ShellExecute</code>.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.
[Ramsay](https://attack.mitre.org/software/S0458) has been executed through malicious e-mail attachments.(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can use the Windows COM API to schedule tasks and maintain persistence.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has been delivered using OLE objects in malicious documents.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.(Citation: Eset Ramsay May 2020)
Phantom DLL Hijacking of Windows services: Windows Search hijacking msfte.dll, Microsoft Distributed Transaction Coordinator hijacking an Oracle dependency oci.dll.
Propagation to network shares using scheduled jobs and Windows Management Instrumentation.
[Ramsay](https://attack.mitre.org/software/S0458) can schedule tasks via the Windows COM API to maintain persistence.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can insert itself into the address space of other applications using the AppInit DLL Registry key.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has created Registry Run keys to establish persistence.(Citation: Antiy CERT Ramsay April 2020)
Propagation to network shares using scheduled jobs and Windows Management Instrumentation.
[Ramsay](https://attack.mitre.org/software/S0458) can schedule tasks via the Windows COM API to maintain persistence.(Citation: Eset Ramsay May 2020)
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
[Ramsay](https://attack.mitre.org/software/S0458) can use <code>ImprovedReflectiveDLLInjection</code> to deploy components.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can insert itself into the address space of other applications using the AppInit DLL Registry key.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has created Registry Run keys to establish persistence.(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can use [UACMe](https://attack.mitre.org/software/S0116) for privilege escalation.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has included a rootkit to evade defenses.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has base64-encoded its portable executable and hidden itself under a JPG header. [Ramsay](https://attack.mitre.org/software/S0458) can also embed information within document footers.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has PE data embedded within JPEG files contained within Word documents.(Citation: Antiy CERT Ramsay April 2020)
JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer. Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. TEARDROP created and read from a file with a fake JPG header.
[Ramsay](https://attack.mitre.org/software/S0458) has masqueraded as a JPG image file.(Citation: Eset Ramsay May 2020)
Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.
[Ramsay](https://attack.mitre.org/software/S0458) has masqueraded as a 7zip installer.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
[Ramsay](https://attack.mitre.org/software/S0458) can use <code>ImprovedReflectiveDLLInjection</code> to deploy components.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can extract its agent from the body of a malicious document.(Citation: Eset Ramsay May 2020)
QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells. Ramsay can also embed information within document footers.
[Ramsay](https://attack.mitre.org/software/S0458) can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.(Citation: Eset Ramsay May 2020)
Phantom DLL Hijacking of Windows services: Windows Search hijacking msfte.dll, Microsoft Distributed Transaction Coordinator hijacking an Oracle dependency oci.dll.
Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.
[Ramsay](https://attack.mitre.org/software/S0458) can use [ipconfig](https://attack.mitre.org/software/S0100) and [Arp](https://attack.mitre.org/software/S0099) to collect network configuration information, including routing information and ARP tables.(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can scan for systems that are vulnerable to the EternalBlue exploit.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can use <code>netstat</code> to enumerate network connections.(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can gather a list of running processes by using [Tasklist](https://attack.mitre.org/software/S0057).(Citation: Antiy CERT Ramsay April 2020)
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
[Ramsay](https://attack.mitre.org/software/S0458) can collect directory and file lists.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can scan for removable media which may contain documents for collection.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can scan for network drives which may contain documents for collection.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can spread itself by infecting other portable executable files on networks shared drives.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can spread itself by infecting other portable executable files on removable drives.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can collect Microsoft Word documents from the target's file system, as well as <code>.txt</code>, <code>.doc</code>, and <code>.xls</code> files from the Internet Explorer cache.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can collect data from removable media and stage it for exfiltration.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can collect data from network drives and stage it for exfiltration.(Citation: Eset Ramsay May 2020)
collects information that is staged on the USB drive for exfiltration.
[Ramsay](https://attack.mitre.org/software/S0458) can stage data prior to exfiltration in <code>%APPDATA%\Microsoft\UserSetting</code> and <code>%APPDATA%\Microsoft\UserSetting\MediaCache</code>.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can take screenshots every 30 seconds as well as when an external removable storage device is connected.(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.(Citation: Eset Ramsay May 2020)
The files were grouped and archived in a password-protected RAR file
[Ramsay](https://attack.mitre.org/software/S0458) can compress and archive collected files using WinRAR.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
[Ramsay](https://attack.mitre.org/software/S0458) can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.(Citation: Eset Ramsay May 2020)
[Ramsay](https://attack.mitre.org/software/S0458) has used HTTP for C2.(Citation: Antiy CERT Ramsay April 2020)
the attacker sends commands to the malware placed on the air-gapped network; this is done via a covert communication channel often placed on a USB drive
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
[Ramsay](https://attack.mitre.org/software/S0458) has used base64 to encode its C2 traffic.(Citation: Antiy CERT Ramsay April 2020)
used USB drives as the physical transmission medium to transfer information across air gaps.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.