Extracted

• • Target
    vova.exe
  • Size 3.5MB
  • SHA256 262133241e31c185073fcc6e1df4ca4e67c0bef4c57663d45f3b101b539cddb7
  • MD5 93bc1b1bc4df3befd93f8a25451ac64a
  • SHA1 e988dd393c976d10d67714bf17dcb70ccd9578aa
  • SHA512 7bc2bc727bb5c3a4d4881c1e08366045b52e5417687502be668573adab6036d9c9514e6cd77b2c50d624febabdec8a68bf48b16982ad7518b414b7a5c0f5e9a2
  • SSDEEP 49152:gmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sk:hq0WgVUuHjkDGjYQeqpgmltk
  • TLSH
    T1B106CF407BD0CE1BE19F87B6B4F2021057B5ED15A796E70B2E90BAAC1CB37445E1839B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasiondiscoveryexecutionexploitratonratpackerpersistenceprivilege_escalationransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Renames multiple (147) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Possible privilege escalation attempt

    exploit

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1