Antiy CERT Ramsay April 2020

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.

Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Ramsay has PE data embedded within JPEG files contained within Word documents.

Ramsay has masqueraded as a 7zip installer.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

Ramsay can use netstat to enumerate network connections.

Ramsay can gather a list of running processes by using Tasklist.

Ramsay has included embedded Visual Basic scripts in malicious documents.

Ramsay has used HTTP for C2.

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

Ramsay can collect directory and file lists.

Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.

Ramsay can scan for removable media which may contain documents for collection.

Ramsay has used base64 to encode its C2 traffic.

Ramsay can scan for network drives which may contain documents for collection.

Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Ramsay has been executed through malicious e-mail attachments.

Ramsay has created Registry Run keys to establish persistence.

Ramsay can use UACMe for privilege escalation.

Ramsay can compress and archive collected files using WinRAR.

Ramsay has been distributed through spearphishing emails with malicious attachments.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.