Ramsay

ATP Sandbox Adv. HeuristicsAV

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

39 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
T1106Native API
T1203Exploitation for Client Execution
T1204User Execution
- T1204.002Malicious File
T1559Inter-Process Communication
- T1559.002Dynamic Data Exchange
- T1559.001Component Object Model

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1546Event Triggered Execution
- T1546.010AppInit DLLs
T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1014Rootkit
T1027Obfuscated Files or Information
- T1027.003Steganography
T1027Obfuscated Files or Information
- T1027.003Steganography
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

TA0007 Discovery

T1016System Network Configuration Discovery
T1046Network Service Discovery
T1049System Network Connections Discovery
T1057Process Discovery
T1083File and Directory Discovery
T1120Peripheral Device Discovery
T1135Network Share Discovery
T1680Local Storage Discovery

TA0008 Lateral Movement

T1080Taint Shared Content
T1091Replication Through Removable Media

TA0009 Collection

T1005Data from Local System
T1025Data from Removable Media
T1039Data from Network Shared Drive
T1074Data Staged
- T1074.001Local Data Staging
T1113Screen Capture
T1119Automated Collection
T1560Archive Collected Data
- T1560.003Archive via Custom Method
- T1560.001Archive via Utility

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1132Data Encoding
- T1132.001Standard Encoding

Alert name variants

Alert Name	Engine
Gen:Variant.Ramsay.1	AV
Gen:Variant.Ramsay.10	AV
Gen:Variant.Ramsay.2	AV
Gen:Variant.Ramsay.4	AV
Gen:Variant.Ramsay.5	AV
Trojan.Ramsay.1	AV
Win32.Spyware.Ramsay	ATP Sandbox Adv. Heuristics
Win32.Trojan.Ramsay	ATP Sandbox Adv. Heuristics
Win64.Trojan.Ramsay	ATP Sandbox Adv. Heuristics

Related families

InvisiMole QakBot PlugX Cobalt Strike NETWIRE