ratonrat | gta 5 installer fr[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
gta 5 installer fr.exe
Size 94KB
Sample260705-w9dmmsax4p
SHA256 ffb2cf400e8633e44e8add03307e7be4d2f9e226c0c956bc3f0c728c9f3ec3b0
MD5 b300d5915c39b1fc103aa2a6e5098c48
SHA1 c87c63042e223ed0f29a8c7d27e10aa18cf7bb43
SHA512 bad9fce8ae02324e2a3641d518e90090d65b8c49659dd6c99507aa67659b29f77229db82336bc60933708f5729c4be7d68572ad516f567b2a142214a83b2b089
SSDEEP 1536:XguAUv0y8+NJJTsqa4tsi5b9s27/q/SbgKp+CpC8Ov1e:XguTv0y8SjAX4tnN9z7/4SbgKzpCfvw
TLSH
T11F934A0473FC292AE3FF8FBD69B550501F72B9279E31D74D498A90980A70B869D20F67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura packer stealer ratonrat

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

192.168.100.250:8347

Mutex

DHCf4mvE0uSghlyBOV7krDP

Attributes

assist
true
box
false
box_icon
No icon
box_msg
Hello, i'm the description of your raton client message box
box_title
Hello, im a title for your message box
defender
true
delay
0
hide_file
true
open_website
false
process_critical
true
reconnect
3
startup
true
tag
Infected
uac
true
vm
true
website
https://t.me/sillyisafed

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
sample	family_ratonrat

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
gta 5 installer fr.exe
unpack001/costura.dll
unpack001/messagepacklib.dll

File Explorer

gta 5 installer fr.exe

.exe 94KB
costura.dll

.dll 5KB
costura.pdb

7KB
messagepacklib.dll

.dll 10KB
system.buffers.dll

.dll 20KB

gta 5 installer fr.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ffb2cf400e8633e44e8add03307e7be4d2f9e226c0c956bc3f0c728c9f3ec3b0
MD5 b300d5915c39b1fc103aa2a6e5098c48
SHA1 c87c63042e223ed0f29a8c7d27e10aa18cf7bb43
SHA512 bad9fce8ae02324e2a3641d518e90090d65b8c49659dd6c99507aa67659b29f77229db82336bc60933708f5729c4be7d68572ad516f567b2a142214a83b2b089
SSDEEP 1536:XguAUv0y8+NJJTsqa4tsi5b9s27/q/SbgKp+CpC8Ov1e:XguTv0y8SjAX4tnN9z7/4SbgKzpCfvw
TLSH
T11F934A0473FC292AE3FF8FBD69B550501F72B9279E31D74D498A90980A70B869D20F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

messagepacklib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30fc8808c22b5073ca2c691784369a36dbdb855aa1b9e50c909225c5562b0e95
MD5 e14bf49aa22e8b4b13cee211f9c246dd
SHA1 67a52a50875b6072355d725cd38dd69a592f6480
SHA512 5cedb8c0de141be1db2afb60e42621d1ac87b493bceea7fe64eeb774ebfd598155301a498a4b2ec40af89a79192f742b665055c5496c7a20469d0718378061c2
SSDEEP 192:ittESK1s9acvVfbTa+fwcOADyxZK0ffCZyO+:0EC3jwcOdxZKSCZyJ
TLSH
T1B422F91CF380856FCEAA077C7CB216452776F2086553DFAA0D88B4FB5D537A40A22659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

gta 5 installer fr.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

messagepacklib.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet