ratonrat | 1c779be5c40ddad47b5ea615d3b06c58b54ab573c4f990b09e1b4c7c75dba20a

Sharing

Copy URL Twitter E-mail

General

Target
RatonRAT3.8.0.7z
Size 28.4MB
Sample260624-wxedeaet3x
SHA256 1c779be5c40ddad47b5ea615d3b06c58b54ab573c4f990b09e1b4c7c75dba20a
MD5 496b64d6497d5b7444ff1756ad519071
SHA1 a82cbbd4ca6c8f89ba07d23b63f10794efc9f9b3
SHA512 c41c89bdcb3c2171eca2a2bf9bfe1b27093d4325113eb143825032b672baa728ccd94f51968cdbe8b1e5f492d676e09f2e9cab6c1aaaddf57284394fb86ad2aa
SSDEEP 786432:SdBfTKQD6YXdrHytJYbsP8awE65pkQgA944MJaJ:SdNhtYoNjP9LG+
TLSH
T1C46733C7A4B9816F6077D326B9C05D2EF09D0F363868740C952DF92BBD763C1AE1A816
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

Mutex

silly1

Attributes

assist
silly11
box
silly8
box_icon
silly10
box_msg
silly9
box_title
silly17
defender
silly23
delay
silly5
hide_file
silly7
open_website
silly13
password
silly20
process_critical
silly6
raw
silly21
reconnect
silly22
startup
silly4
tag
silly16
uac
silly11
vm
silly15
website
silly14

Targets

- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Builder/Client.exe
- Size 93KB
- SHA256 6c41fa2f4ec3d30efc4aa42c5084bc48ec687d755c30770b37d94836e5fb49fe
- MD5 4cbd857d7e365e4c1375e0dc632943dd
- SHA1 34baf49f25aefdc98ffefd9267fd6f61903245a8
- SHA512 46ac9bafb8ca5187ae74eb79a50a94785e0ac5caf4bb7dacebc3f24df519b5eed13bc34b4a4dee27cd3083aff6a2ddc1e960334007f9aa0fa819d7a363155863
- SSDEEP 1536:s/ugsp5RjLl9VlrT8qS4tsi5gy6KiSbPK3sCsCQXbuR:9gsjRjLl9DwX4tnbiSbPKfsCoqR
- TLSH
  T129936C0473EC6B16E6BFCB7E5CB554505F32BA172E71D25C8C8A60AD0A70782AD10FA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral1 behavioral2
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Builder/clientForCrypters.exe
- Size 3.5MB
- SHA256 8e817dcdc9b30f53bb9207d2e2200052d48e5233d3a0e3dcebc3ce88e194b5ce
- MD5 0de95d21e3fcf16d9b216057038afc06
- SHA1 2755c3006cd7a8f87f783f7ee2ba6e8792fde6cd
- SHA512 9de7c0347dc11c7e5f3cd4582065eb8fd1fffc6ec0a6a04a27470efdd644f2a6dc4d5dc635dbe86dc509b756b4e906ccd9ac0675e3e416cfa06d4c4002f04984
- SSDEEP 49152:xmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9s:6q0WgVUuHjkDGjYQeqpgmlt
- TLSH
  T1AC06CF407BD0CE1BE1AF87B6B4F2061057B5EC15A796E70B2D90B6AC1CB37446E1839B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer adware persistence ransomware spyware
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/DONOTDELETE/Commands.dll
- Size 3.4MB
- SHA256 e809495c34524a4bbf57de1ca2d57ee2f254f61b11f9a460085841a4f5890926
- MD5 92d3ad1f8c1c7eed7e34cd1191fb5402
- SHA1 31a2840e7ee40b8db77297a66a495129e1b653b3
- SHA512 22bd0f2931d6f41fc46790f7ed53f928051cd26020580251b405244d2572e510ea0baf299c121a314fd50e6b3723d92398d4aa8fc90a83fd1eebe12bf360b22b
- SSDEEP 49152:Tmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9s:Yq0WgVUuHjkDGjYQeqpgmlt
- TLSH
  T100F5CE417BD0CE5BE19F87B6B4F2021057B5EC54A796E70B2E90BAAC1CB37441E1839B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/EntityFramework.SqlServer.dll
- Size 577KB
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH
  T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/EntityFramework.dll
- Size 4.8MB
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH
  T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/GMap.NET.Core.dll
- Size 304KB
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH
  T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/GMap.NET.WindowsPresentation.dll
- Size 55KB
- SHA256 194fc0defdb71052d9acd21c9bd004f8b98f463e95fad5f8106d9c9e7c674e19
- MD5 0ed344a5005d6e31e448f1a23d26e307
- SHA1 3bc89732fc9f788ec1cdd9454858d3d3a8bd458d
- SHA512 eef285b60ef066e49789237451bc8dbdcf6e892935741e6c9978ebbc4b355c93ef69f417ca30798096197a1ce282d1ac27d185281ea73ad0183777f695c49dff
- SSDEEP 1536:U191sCtO1MZvboXcDYBVIV5aBIzEX5TZ:w91Jo1MZcccPcasMZ
- TLSH
  T1C3433A91A3684A2FD9BF0BFAD4A402111B71C657B622E78D1FF490BD89DB38106163DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/MessagePackLib.dll
- Size 11KB
- SHA256 0d10269ef6e07a7bc18f80a4178dca6d384c0f08fff150b9ea3bf2083bc69360
- MD5 a805eca2b129bda1ef793798fde57810
- SHA1 3b089b80751660a5d1c0ef94ba052f3973de53e0
- SHA512 b7bc68f190e5d43d59752c18d76a5df44f4af2c603f37be891957e2b4599a8d07ba8c57d9edc29affcce9d1667e26ef6e07711b24c17e7a24dec3a7b141f7852
- SSDEEP 192:ibcn+VG13cpi+BhUaM191EvK+OADyxMK0ffCZ2ku:iE3m2avK+OdxMKSCZ2L
- TLSH
  T121320A5CA784826BED7D0BBDBC9253062376D214AF43EB5E1C8CB8BA6D173680612770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Microsoft.Bcl.AsyncInterfaces.dll
- Size 27KB
- SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
- MD5 6b81ffcec37066c94500d0845f580e91
- SHA1 795e193099214a767cb642c2b48022ef3e59e63d
- SHA512 9213cd310664c429c4d1981b530639c33104b9d17ed8121304af6ec48ee6c3095f4d78365ad7d6141b2a18a0acfaabfa63211420248c0d891c6078dfb2608c45
- SSDEEP 384:snuDmDZGXTmBxeg0ZrS2Yh0WXIdGl+IWY6FU2jWeT/WjjPDHRN77LDGTYAsR9zJn:suwIqBxEZ22LwJgFU23EvyMj9zGxji
- TLSH
  T125C26C55D36C4313CFAE2FB5E969C6822D74E38A3C33DA3E1248E6550C97788A63523D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Microsoft.Toolkit.Uwp.Notifications.dll
- Size 158KB
- SHA256 a0b5be9580bf6548f685d79e5439f6d946ef57e013d201f946b2a894e7441804
- MD5 805135da62c5b65618b9782a5dc48f06
- SHA1 4f074c676e8a93ea4e618db0e2af4d5d2463ac17
- SHA512 8594aef25db9e73dbad999f6e4cbfe548fa82e41d94c6396f51213809bab01b043c1238171cd44fc962e0f53050e4067a449aeec07fd23b511a1003e71e2bb65
- SSDEEP 3072:V4burBkDijpS3+n1Sr5ePVM761+fAwb7xp:ViikDiw3+1af761+r7
- TLSH
  T16AF35C2D33AC877AFAEF17B4F8F424154F77FA4B7429D2598A0495AD5813B8081523B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH
  T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 d65e445a02dc2d2a189d19745f14368c6a24d05914e36bbc7ed9732962998ea5
- MD5 a97d8b05414aaaa056d6aec577ab15a8
- SHA1 19b2a8967106dddbdb60d09d6012bae36d0d17ea
- SHA512 be05b237d8beaa52ae22a97a27280341a5eab3f88e59816c9c699ca9fe74ac22b0e5e8611cf4ddce1f13d5f8afc2153422906fe08dffc74c742529dd4358dc25
- SSDEEP 768:Yr5EYZep98C87KHeBUZwrEe9EAnlF+em5Kktn4CRIcZwMRTIzCuAtpx:Yr59g98C87KHeBUbTAnXGVXdwMRTOAtr
- TLSH
  T1AD1319156BFC8B27C29E51FEA4D226060BF19178A513FBA79EC0E5F7BC43B45450222B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Mono.Cecil.Pdb.dll
- Size 87KB
- SHA256 8e221211df8a917d69145239b71b71c87e61761fb0c96d5e997964c172dda4c0
- MD5 358ee793e3f5139ec1f835f0cf306baf
- SHA1 be0a3453276ae078d66eebed4f3516f246805cef
- SHA512 b48a78e55573c29ea925138753f4996309929cf1ada435e1c88ae3b9f97b13eaaccb2e756f929b341ab9110204f85b5d024e65364e023e286fe2f8e50c7d712c
- SSDEEP 1536:ifCEVETXo3f+yAvaDvNaPS/vSC6GOALYKXgAJGsZAhcbcvjCXej:kuiQPwvH6rArVJGXh+cveXej
- TLSH
  T196938D35E798672AE5DD797628A60D050BF1D2B9C153A70E4A84FEF83E0B7121973383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  v3.8.0 Deluxe Plugins (v4.0.0)/Mono.Cecil.Rocks.dll
- Size 29KB
- SHA256 9db3edaa8bc6ccd7ac6e2517c743591658bd6bdd436a146e0eda101d30a1332e
- MD5 6fcdf77e1f173f269ff56752f273f094
- SHA1 d9d26753c23fab955bb20289a20e37a1812888dc
- SHA512 84f87537685ff55a681bf2acb4e35f77ea6ef3afc3cfb6257b7a72a62ba7f27e6a580fda89ddde2d8f9c22cce6a94622b58fe344d8fa52ff163d7cbc7d7a1804
- SSDEEP 768:7gVxLIKwiowt0j1KODTq7/hRssvewJ1pfFpFo:s/6wtm1J3Wjssvew3o
- TLSH
  T11AD22A0217A6CF3BC1EF5D7AB8F2132801B1C6863003DB664DCCA2E9694BB955B613E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32