Extracted

• • Target
    AutoClicker.exe
  • Size 1.1MB
  • SHA256 1ce7da6f2813c2ad1d2e496be6714e08cd618e6d9fe2df26c2bd4d894c9a6ec1
  • MD5 913a423f66aa1c41e374e21a911a3c20
  • SHA1 449df612d0f02e868992faabfbf4d5d37c727936
  • SHA512 ee01f1a322e982bfd6618920e4ec9decf23317628f39dc9b771ff4f758fef3c9266cebbeaeb8ba1e4bbb1f0b683cba1aa3a533bce62a706e7dfd2a7d3bdd1f73
  • SSDEEP 24576:pRaZROMOm8FN7TjsPnzt2heeRhQbJpOQam1Mfu37d:zkxOm+7TjsPnztyDMBayMc
  • TLSH
    T169455B5523A44199FE6AF0F68A52C106D6B17C4A12B6CB1F01B039B52F736B3DE1E31B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistenceransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Renames multiple (161) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1