Extracted

• • Target
    https://bazaar.abuse.ch/download/716476cc78390e35b6644f61f7a38fd3cbb23588eb1c48858ab42dc495968eae/

  Score

  10^/10

  defense_evasiondiscoveryexecutionovinratpersistencerat

  • Family: OvinRAT

    OvinRAT is a Windows RAT written in Rust.

    ratovinrat

  • Looks for VirtualBox drivers on disk

    defense_evasion

  • Looks for VMWare drivers on disk

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1