Search/Ramsay
● Malware

Ramsay

Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.

View graph Watch Export
Indicators tracked
0
Intelligence Reports20
20 intelligence reports available

Curated threat research and citations from CrowdStrike, Mandiant, Microsoft, and other sources — unlock with Premium.

Upgrade to Premium
Connections
40 relationships
T1053.005: Scheduled Task
source
T1560.001: Archive via Utility
source
T1113: Screen Capture
source
T1132.001: Standard Encoding
source
T1014: Rootkit
source
T1548.002: Bypass User Account Control
source
T1560.003: Archive via Custom Method
source
T1025: Data from Removable Media
source
T1074.001: Local Data Staging
source
T1036.005: Match Legitimate Resource Name or Location
source
T1559.002: Dynamic Data Exchange
source
T1204.002: Malicious File
source
T1080: Taint Shared Content
source
T1566.001: Spearphishing Attachment
source
T1559.001: Component Object Model
source
T1574.001: DLL
source
T1119: Automated Collection
source
T1135: Network Share Discovery
source
T1120: Peripheral Device Discovery
source
T1106: Native API
source
T1091: Replication Through Removable Media
source
T1005: Data from Local System
source
T1140: Deobfuscate/Decode Files or Information
source
T1036: Masquerading
source
T1016: System Network Configuration Discovery
source
T1083: File and Directory Discovery
source
T1049: System Network Connections Discovery
source
T1057: Process Discovery
source
T1547.001: Registry Run Keys / Startup Folder
source
T1039: Data from Network Shared Drive
source
T1027: Obfuscated Files or Information
source
T1203: Exploitation for Client Execution
source
T1027.003: Steganography
source
T1546.010: AppInit DLLs
source
T1071.001: Web Protocols
source
T1059.005: Visual Basic
source
T1046: Network Service Discovery
source
T1680: Local Storage Discovery
source
T1055.001: Dynamic-link Library Injection
source