General
- Target https://cdn.discordapp.com/attachments/1510729993674555494/1523381684819460286/gta_5_installer_fr.exe?ex=6a4be740&is=6a4a95c0&hm=8b082aae8a5f8c1e4c615b41099a7c2242461cacaede8a9e52cd0715cf2b12ed&
- Sample260705-xa6ptae14s
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1510729993674555494/1523381684819460286/gta_5_installer_fr.exe?ex=6a4be740&is=6a4a95c0&hm=8b082aae8a5f8c1e4c615b41099a7c2242461cacaede8a9e52cd0715cf2b12ed&
Resource
win11-20260513-en
21 signatures
150 seconds
Malware Config
Extracted
Family
-
ratonrat
Version
-
v4.0.0
C2
-
192.168.100.250:8347
Mutex
-
DHCf4mvE0uSghlyBOV7krDP
Attributes
-
assist
true
-
box
false
-
box_icon
No icon
-
box_msg
Hello, i'm the description of your raton client message box
-
box_title
Hello, im a title for your message box
-
defender
true
-
delay
0
-
hide_file
true
-
open_website
false
-
process_critical
true
-
reconnect
3
-
startup
true
-
tag
Infected
-
uac
true
-
vm
true
-
website
https://t.me/sillyisafed
Targets
-
- Target https://cdn.discordapp.com/attachments/1510729993674555494/1523381684819460286/gta_5_installer_fr.exe?ex=6a4be740&is=6a4a95c0&hm=8b082aae8a5f8c1e4c615b41099a7c2242461cacaede8a9e52cd0715cf2b12ed&
-
Detects RatonRAT payload
-
Downloads MZ/PE file
-
Executes dropped EXE