Eset Ramsay May 2020

Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.

Ramsay has included a rootkit to evade defenses.

Ramsay can collect data from removable media and stage it for exfiltration.

Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.

Ramsay has masqueraded as a JPG image file.

Ramsay has masqueraded as a 7zip installer.

Ramsay can collect data from network drives and stage it for exfiltration.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

Ramsay can schedule tasks via the Windows COM API to maintain persistence.

Ramsay can use ImprovedReflectiveDLLInjection to deploy components.

Ramsay has included embedded Visual Basic scripts in malicious documents.

Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

Ramsay can spread itself by infecting other portable executable files on networks shared drives.

Ramsay can collect directory and file lists.

Ramsay can spread itself by infecting other portable executable files on removable drives.

Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations. Ramsay can execute its embedded components via CreateProcessA and ShellExecute.

Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.

Ramsay can scan for removable media which may contain documents for collection.

Ramsay can scan for network drives which may contain documents for collection.

Ramsay can extract its agent from the body of a malicious document.

Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.

Ramsay can use UACMe for privilege escalation.

Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

Ramsay has been delivered using OLE objects in malicious documents.

Ramsay can compress and archive collected files using WinRAR.

Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.

Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.