Extracted

• • Target
    ratonClient.exe
  • Size 2.4MB
  • SHA256 84eec6e57783b54191ee477646883cadeaf6a953098a63c3bd94e8635222b2f8
  • MD5 642def51c5ece4ab8e89c01b0a180807
  • SHA1 aeccc1e5b1866914aec943f1d67836b2aad13827
  • SHA512 ede335d4ada659a924e53c1a65801122f6fb47815c1d04e3de9e72fd6199cdc8a4e3b0142773c90046a489f967fd0ef6f81461a3e7ecb76413067b7211eda35c
  • SSDEEP 49152:qgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw49An4i:qgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1DEC5011C33F9C618F1AF4BF4A47189664771FD179C62DBAC58A139AE04B6F44BA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionratonratpersistenceprivilege_escalationransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2