19f378aaa4bf54e7c98818386bbd9d3c135a6c5e51359967ad0ab60523658390

General

Target
RatC!Q.exe
Size 106.2MB
Sample260620-drpcbacz2r
SHA256 19f378aaa4bf54e7c98818386bbd9d3c135a6c5e51359967ad0ab60523658390
MD5 402de04125731536979ca82edfeff409
SHA1 c4b6eb53dd0af9b56b1f640370ea8b8d6f9b3755
SHA512 5371a09d0ceca7cccf548abf6ebf09d5577d78545e5053346bb8205d7b06005932d47e1ed0e9908e2044c1c036b2b69d80e90a8166b582b31b8b45efcabadc66
SSDEEP 3145728:eVgYRPSC++6y9lUB2h82D3SapRr5HV8F9eSqjxfKd7:ExaC4y9lUB2hR2apRro3li+
TLSH
T1B9383358FDD474C7EA9C47746112DB0EE848714EB25B85AB51B002AA0CF32CAF7F6B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  RatC!Q.exe
- Size 106.2MB
- SHA256 19f378aaa4bf54e7c98818386bbd9d3c135a6c5e51359967ad0ab60523658390
- MD5 402de04125731536979ca82edfeff409
- SHA1 c4b6eb53dd0af9b56b1f640370ea8b8d6f9b3755
- SHA512 5371a09d0ceca7cccf548abf6ebf09d5577d78545e5053346bb8205d7b06005932d47e1ed0e9908e2044c1c036b2b69d80e90a8166b582b31b8b45efcabadc66
- SSDEEP 3145728:eVgYRPSC++6y9lUB2h82D3SapRr5HV8F9eSqjxfKd7:ExaC4y9lUB2hR2apRro3li+
- TLSH
  T1B9383358FDD474C7EA9C47746112DB0EE848714EB25B85AB51B002AA0CF32CAF7F6B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

credential_access discovery execution persistence privilege_escalation spyware stealer adware ransomware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2