General
- Target https://gofile.io/d/Ph53lB
- Sample260629-3y76fabs7m
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofile.io/d/Ph53lB
Resource
win11-20260513-en
22 signatures
150 seconds
Malware Config
Extracted
Family
-
ratonrat
Version
-
v4.0.0
C2
-
portbuddy.dev:40644
Mutex
-
qMl58ePiPxhRRjbwwOJuXYv
Attributes
-
assist
false
-
box
true
-
box_icon
Information
-
box_msg
New version of larp exodus (1.1.1.5) is out.
-
box_title
Old version of larp wallet
-
defender
true
-
delay
0
-
hide_file
false
-
open_website
true
-
process_critical
true
-
raw
silly21
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://discord.gg/5Ta5nKpc
Targets
-
- Target https://gofile.io/d/Ph53lB
-
Detects RatonRAT payload
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.