ratonrat | RyukClientExecuto[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RyukClientExecuto.exe
Size 3.9MB
Sample260708-2dx93aaz3x
SHA256 31be22bf9565bf8941c53279cc7dfac4e20d21a8b62b619c59ff707b15a775a9
MD5 481b3d1f1242e77934479a7da49be431
SHA1 e5f1db6328d0bdeb3b3807f8b41735f336139c1a
SHA512 6fde81a920b3e3419e609ee9e31f9a4b93415442c686f60054b9c70497db4b179449dc11ecb7a8cace23dbd483f48bcbb72e32cf0b3d2fec54159ff371ffc9d1
SSDEEP 49152:Nmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sH:2q0WgVUuHjkDGjYQeqpgmltH
TLSH
T12A166B40A794D947D05FF2F2B8ADCE00227AED8F536F97062B52FD5D58AF3422815A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura packer stealer ratonrat

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

portbuddy.dev:40644

Mutex

dyCO1VinsWruzl3uCRZigq1

Attributes

assist
false
box
true
box_icon
Information
box_msg
Ryuk Client Executor Server's Are Currently Offline, Please Try Again Later
box_title
Ryuk Client Server
defender
true
delay
0
hide_file
false
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
sample	family_ratonrat

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
RyukClientExecuto.exe
unpack001/costura.dll
unpack001/messagepacklib.dll

File Explorer

RyukClientExecuto.exe

.exe 3.9MB
costura.dll

.dll 5KB
costura.pdb

7KB
messagepacklib.dll

.dll 10KB
system.buffers.dll

.dll 20KB

RyukClientExecuto.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 31be22bf9565bf8941c53279cc7dfac4e20d21a8b62b619c59ff707b15a775a9
MD5 481b3d1f1242e77934479a7da49be431
SHA1 e5f1db6328d0bdeb3b3807f8b41735f336139c1a
SHA512 6fde81a920b3e3419e609ee9e31f9a4b93415442c686f60054b9c70497db4b179449dc11ecb7a8cace23dbd483f48bcbb72e32cf0b3d2fec54159ff371ffc9d1
SSDEEP 49152:Nmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sH:2q0WgVUuHjkDGjYQeqpgmltH
TLSH
T12A166B40A794D947D05FF2F2B8ADCE00227AED8F536F97062B52FD5D58AF3422815A0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3701054

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

messagepacklib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30fc8808c22b5073ca2c691784369a36dbdb855aa1b9e50c909225c5562b0e95
MD5 e14bf49aa22e8b4b13cee211f9c246dd
SHA1 67a52a50875b6072355d725cd38dd69a592f6480
SHA512 5cedb8c0de141be1db2afb60e42621d1ac87b493bceea7fe64eeb774ebfd598155301a498a4b2ec40af89a79192f742b665055c5496c7a20469d0718378061c2
SSDEEP 192:ittESK1s9acvVfbTa+fwcOADyxZK0ffCZyO+:0EC3jwcOdxZKSCZyJ
TLSH
T1B422F91CF380856FCEAA077C7CB216452776F2086553DFAA0D88B4FB5D537A40A22659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 2, 2019 - May 2, 2020

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FF06-4BC3-B9DA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Serial Number

33:00:00:01:14:35:27:45:ea:b6:c8:6c:4f:00:00:00:00:01:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2019 - Jan 21, 2021

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

RyukClientExecuto.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

messagepacklib.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet