ratonrat | Steam[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Steam.exe
Size 3.5MB
Sample260629-yfbbjadz2w
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura packer stealer ratonrat

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

ports.crabdance.com:20213

Mutex

LzyPt4WF0EbG2dfH1JqsEiE

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
kupil
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
sample	family_ratonrat

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
Steam.exe
unpack001/costura.dll
unpack001/messagepacklib.dll

File Explorer

Steam.exe

.exe 3.5MB
costura.dll

.dll 5KB
costura.pdb

7KB
messagepacklib.dll

.dll 10KB
system.buffers.dll

.dll 20KB

Steam.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 551b7dc8f7962b953895db71d1d02ba75993f08f080093d4022d6abf1d6a5532
MD5 232f3e506ab6fceea3ec5a24354b0e50
SHA1 5353dea996d281e5847257fe9f0ec3605adcc469
SHA512 c08df3ede98187b1d6fc09f850930ff6f77534232b14c099c90732fb11a91fdc280a3a7aa131025dd6d6c9590e48d375f93900fa5b698a6df30e9b96fc9662bd
SSDEEP 49152:qmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sv:Pq0WgVUuHjkDGjYQeqpgmltv
TLSH
T16806CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3700926

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

messagepacklib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30fc8808c22b5073ca2c691784369a36dbdb855aa1b9e50c909225c5562b0e95
MD5 e14bf49aa22e8b4b13cee211f9c246dd
SHA1 67a52a50875b6072355d725cd38dd69a592f6480
SHA512 5cedb8c0de141be1db2afb60e42621d1ac87b493bceea7fe64eeb774ebfd598155301a498a4b2ec40af89a79192f742b665055c5496c7a20469d0718378061c2
SSDEEP 192:ittESK1s9acvVfbTa+fwcOADyxZK0ffCZyO+:0EC3jwcOdxZKSCZyJ
TLSH
T1B422F91CF380856FCEAA077C7CB216452776F2086553DFAA0D88B4FB5D537A40A22659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

Steam.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

messagepacklib.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet