Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Ramsay

Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)

ID: S0458

Type: MALWARE

Platforms: Windows

Version: 1.1

Created: 27 May 2020

Last Modified: 14 Apr 2021

Domain	ID		Name	Use
Techniques Used
Enterprise	T1548	.002	Abuse Elevation Control Mechanism: Bypass User Account Control	Ramsay can use UACMe for privilege escalation.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	Ramsay has used HTTP for C2.(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1560	.001	Archive Collected Data: Archive via Utility	Ramsay can compress and archive collected files using WinRAR.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
		.003	Archive Collected Data: Archive via Custom Method	Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.(Citation: Eset Ramsay May 2020)
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Ramsay has created Registry Run keys to establish persistence.(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1059	.005	Command and Scripting Interpreter: Visual Basic	Ramsay has included embedded Visual Basic scripts in malicious documents.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1132	.001	Data Encoding: Standard Encoding	Ramsay has used base64 to encode its C2 traffic.(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1074	.001	Data Staged: Local Data Staging	Ramsay can stage data prior to exfiltration in `%APPDATA%\Microsoft\UserSetting` and `%APPDATA%\Microsoft\UserSetting\MediaCache`.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1546	.010	Event Triggered Execution: AppInit DLLs	Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.(Citation: Eset Ramsay May 2020)
Enterprise	T1574	.001	Hijack Execution Flow: DLL Search Order Hijacking	Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.(Citation: Eset Ramsay May 2020)
Enterprise	T1559	.001	Inter-Process Communication: Component Object Model	Ramsay can use the Windows COM API to schedule tasks and maintain persistence.(Citation: Eset Ramsay May 2020)
		.002	Inter-Process Communication: Dynamic Data Exchange	Ramsay has been delivered using OLE objects in malicious documents.(Citation: Eset Ramsay May 2020)
Enterprise	T1036	.005	Masquerading: Match Legitimate Name or Location	Ramsay has masqueraded as a 7zip installer.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1027	.003	Obfuscated Files or Information: Steganography	Ramsay has PE data embedded within JPEG files contained within Word documents.(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1566	.001	Phishing: Spearphishing Attachment	Ramsay has been distributed through spearphishing emails with malicious attachments.(Citation: Antiy CERT Ramsay April 2020)
Enterprise	T1055	.001	Process Injection: Dynamic-link Library Injection	Ramsay can use `ImprovedReflectiveDLLInjection` to deploy components.(Citation: Eset Ramsay May 2020)
Enterprise	T1053	.005	Scheduled Task/Job: Scheduled Task	Ramsay can schedule tasks via the Windows COM API to maintain persistence.(Citation: Eset Ramsay May 2020)
Enterprise	T1204	.002	User Execution: Malicious File	Ramsay has been executed through malicious e-mail attachments.(Citation: Antiy CERT Ramsay April 2020)

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Ramsay

Techniques Used

References