ratonrat | 9aeb2df45dc12be8a84804fc2061f9c4440b41caf61cf30bf48ac42acf45f7ec

Sharing

Copy URL Twitter E-mail

General

Target
RatonButCooler.zip
Size 28.2MB
Sample260712-aay9eabs5r
SHA256 9aeb2df45dc12be8a84804fc2061f9c4440b41caf61cf30bf48ac42acf45f7ec
MD5 633c40304e90030a49fcc5bef70d3ca0
SHA1 d12bb9af5a2137f261a2e256a9a12c5f3fd30f74
SHA512 2f02aa8fdb588b34a61d0f5e67b35341154ff8563c9f010c6101fe0b7543da667451ff5eef3ea063587cbaac8a9708ae238a2f053313ac664cb0dad0b1ecdac5
SSDEEP 786432:OmjySz/tc82vUsSRu2796xTVFqKs2z+f+w+Uztu:bvLtc82v696xxFzt6meM
TLSH
T1555733E5D20F8512F4DBDFBB50ED4CEAB37DB581A980B1BF1E16819819E7CC86509A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

Free

Mutex

silly1

Attributes

assist
silly11
box
silly8
box_icon
silly10
box_msg
silly9
box_title
silly17
defender
silly23
delay
silly5
hide_file
silly7
open_website
silly13
password
silly20
process_critical
silly6
raw
silly21
reconnect
silly22
startup
silly4
tag
silly16
uac
silly11
vm
silly15
website
silly14

Targets

- Target
  Free/Assets/builder.html
- Size 20KB
- SHA256 95155dfb76545f7daef728edfd1df0303e6240577487441389771b0f22162ecc
- MD5 f6a895c63189fd51600a98db6f858e13
- SHA1 4676ad050b9d542d2215dafbec1f1b7368335763
- SHA512 a6433389a65e72a52aa5086840c6ce737da641eae76a71ecdc8082729f20a75e5483d1959c3e77de3793ca50b111a5e9da96786b96ad35ad964f9fbe364a59ee
- SSDEEP 384:q9J6YFJoHurDu9f/KZByzgsSmLefe+eg60:q9J6YFJUdp+BNsM
- TLSH
  T153927370E18510665233D6E26BE28B1EFBF88017D60642287BFC538B0FF5D54DA63A9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1
- Target
  Free/Assets/raton.html
- Size 35KB
- SHA256 0a57b42077168fefa6ec85e34ec09c2ac6ce8504952286925368db4251998f05
- MD5 ef59c2e1ef0452fdcf8ed737ca4b3e03
- SHA1 8df70518ea054d2923ba8ecb32c9320e12380cc3
- SHA512 2bd1f16e55dd302d202e2bbdb80fbb1a77c3bff2e68d240c2610e04417d415fa79b03206f7d55c00123bca56ceab3b14edadc1998a48ee4642d67e151d58eac1
- SSDEEP 384:AAkinX0GRdCUMq4qdWHF2L9ta1q0M3l/fA5UN4d:AAkinEGfCUT4qdgFJahA5UA
- TLSH
  T16BF2B71743612069167393A1ABB3EB2AFB7883139146407EB7ED81684F7D4C8C35BE9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  Free/Builder/Client.exe
- Size 594KB
- SHA256 af8e72ffc1e03d9e6550d81c08bdb607180bcaebde56d08996aaa229981a9028
- MD5 7b36a133495827b89ac686931d61e9a6
- SHA1 861ade35c46456b2bdbf75932ac25862dc1cad9c
- SHA512 a08554632fe973ce13af92f80e1a012f6670f878e4cebcfeb955440286502db7fa5c168f793cc0f7d21757baa153953f238a924d4cb092a82b52fc60530f998c
- SSDEEP 12288:u3zR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIW4y:IL4kkA7lXkXDDuAOFhWSApir
- TLSH
  T118D40204B7BC3615E7FE8B3E59F090880FB272535A20E20C5D86D4AD1675B82DA64FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral3
- Target
  Free/Builder/clientForCrypters.exe
- Size 2.4MB
- SHA256 fddc0621273802777acd47c5b732be8b5ca1a48daba0a294d26cb173c5a1f12e
- MD5 acf283f34cbb8bba1dee6693a7da250d
- SHA1 25d34b1c675891224e26875f14ba8776f837ba9e
- SHA512 fa3d283724d37e4b3041225d81606c8502369d77cc4015641c90b337ef366efe4d98f0e3fbe6a8c0d9277c85e1eaed3d23a60525d3bc3f8ed1f6a3f3a8befb17
- SSDEEP 49152:kgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4NAn4m:kgVUuHjkDGjYQDGuRxzew
- TLSH
  T1F3C5011833F9C718F1AF4BF4A47189664771FD179C52DBAC58E139AE04B6F44AA20B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral4
- Target
  Free/Builder/clientForNull.exe
- Size 1.2MB
- SHA256 f0dfca5f3c4aab524b28691fe068a7a5e89c73603581f32bdd597b652ac9e965
- MD5 9fa4d448fe3726d35a034d5df48002a4
- SHA1 ba5b28007042386da5660f999ea393f520c9d5b2
- SHA512 57bcb1230ace0a34e5d67fa7dd5e8ab21b5a00fbebb81cdb8cf7ff389a7b47867d8fc761936f74aa6b34ce83830c74fc32250ead91bf1570de9c765b073f00fb
- SSDEEP 24576:k+wUXSrtv94TP0lRRkxYcxMNnyFoBOkA6s4WIqu5:ydsclR0BxMsaRw4su5
- TLSH
  T10D55DF5C33F98A18F2AF0BF4E8B1451A07B1FD579922D76D19E678DA04B1F44E920B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral5
- Target
  Free/DONOTDELETE/Commands.dll
- Size 3.8MB
- SHA256 cc3bda4bca94c9945cd2d41787573bb463a381df6b0282883b31bb22f825028f
- MD5 e5a92a14893f54588721dacaaf9cb9bb
- SHA1 e0e10c4bdf779549f7f41dc2018081c65a5b6258
- SHA512 672814d9bdb4317c98e287b964fe9b57e77920acea4d54345988a9ae32d3def67ca69242fecf1e491b908a16a42d76ed5d58425048b342130dd33c594075ece8
- SSDEEP 49152:6nFk0GZkQ8sKEggVUlsHjkmiGWU5+5W5pwz5gQSPxY/AlJa6Y+c:wQZkQ8sKEggVUuHjkDGjYQzgGDc
- TLSH
  T1BE06AD01A7E0CE17E1EF1772A4B246024BF2EC45AB62E74B149475BE1CB3B441E1A7E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Free/DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Free/EntityFramework.SqlServer.dll
- Size 577KB
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH
  T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Free/EntityFramework.dll
- Size 4.8MB
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH
  T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Free/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Free/GMap.NET.Core.dll
- Size 304KB
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH
  T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Free/GMap.NET.WindowsForms.dll
- Size 154KB
- SHA256 f09c31a7f0cde63b914826fcd8b47e7267394175d3fab30cb9615519e5817e5f
- MD5 2110dc2c787880b9ed2ef58f17cf8da9
- SHA1 24edeb5fdd96af28425e28f2682f9874c3f9733c
- SHA512 095a26c3c7389fcabc9f5ff24d4877879d84513e628a20248bae693f1a2241a583e398f8662131dd21c07d919c06bf3d9af54f68f10a6e361e1c0f09e1dc8d31
- SSDEEP 3072:oPP4oYc0UGujmTXh7ALGD9vgAJcLv+IEJawdS5DBRS9LXf+6qbugi7vRq:KccbGucgK9vd/0rS9jf+6qq
- TLSH
  T163F39DA273948D7FC66F47BDA0A140C1273AFA02F692D35D5D9070BC4D93B146B227AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Free/MessagePackLib.dll
- Size 11KB
- SHA256 0d10269ef6e07a7bc18f80a4178dca6d384c0f08fff150b9ea3bf2083bc69360
- MD5 a805eca2b129bda1ef793798fde57810
- SHA1 3b089b80751660a5d1c0ef94ba052f3973de53e0
- SHA512 b7bc68f190e5d43d59752c18d76a5df44f4af2c603f37be891957e2b4599a8d07ba8c57d9edc29affcce9d1667e26ef6e07711b24c17e7a24dec3a7b141f7852
- SSDEEP 192:ibcn+VG13cpi+BhUaM191EvK+OADyxMK0ffCZ2ku:iE3m2avK+OdxMKSCZ2L
- TLSH
  T121320A5CA784826BED7D0BBDBC9253062376D214AF43EB5E1C8CB8BA6D173680612770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Free/Microsoft.Bcl.AsyncInterfaces.dll
- Size 20KB
- SHA256 ed5bc605f7f9fcc382183abef06c354dad946abb42a07631712077b2157d6bc9
- MD5 5220eefd7753e11b99d73faf39fbb486
- SHA1 7d8264be4fcb17f81acb8b1add980cd96a6fd856
- SHA512 81e483bd76240543704194c0eb0c8a9e7dc46aa535653e7d5590e00c002b2980237ada793c05c0eedd5d1a92de90055867b21be665ff94fac038e280939c66c1
- SSDEEP 384:Re/UHMWL60VJI0yydaVemxAqD2WepAoWbQHRN7F/Gw6lxA0Zua:c/UsKV9Ki658F+Hua
- TLSH
  T175924B55C3AC4327DFAB3FB695B4DA432E34D3821802D66E185CF2A52CD73899B35368
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Free/Microsoft.Web.WebView2.Core.dll
- Size 634KB
- SHA256 2b999d1775004e98b32f281f4518f3952df650970748527ef5b54fa9979d6c9c
- MD5 225af3c55fbb7376a11dbc4648a2b582
- SHA1 89f5657f8bca7aa571d7b533933dd3ffe744fcdf
- SHA512 6e550daad83e85a189a6709e4757ee8caa27604362be9945cddf1a5a59aaff0f68403255422e243a7aaa2e0fea28c6972187be72b9eb82b76a4523ba3a49aad0
- SSDEEP 12288:6BfVnfFe7bqOarD6niWFynSbOR4qn7BdkJX1Il5g3dM6sq9cZwq4BTpsRkrP322i:GQcl41OZ
- TLSH
  T1D3D4532223FD4619F6F27FB9563817608FB9BC96B939D35E8598502D0D72B809DA0333
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Free/Microsoft.Web.WebView2.WinForms.dll
- Size 38KB
- SHA256 bbc50575b6a191fd433df854227921937f256e91a81b47c697d95ea8ed027ff6
- MD5 1c42da9957dad375688d998aed3b643e
- SHA1 071585c1af48e621fb88c72588910e6ade6f9b3b
- SHA512 1b0a87c3ba81a4252e389c2ec392c1265e429ed85a50952f30340afe3cf1e634685390e7f307f55fd8f8255e1f002c6f8370430a0c0ed2cc46cfdbdc0710c2c2
- SSDEEP 768:HyQNb2vIYymJ22Mss+5lQ+ZDgcEST3p4Jjrjh2jeFSUyauTv1JKia5/Zi/ZGQSxm:HVb2vLblQ+ZDgcEST3p4JjrjaeFSUya6
- TLSH
  T15D033A4087ECC517E6EB2E78B9B491611BBA7EC37DA1D3A90C84F1E90C73B9055143AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Free/Microsoft.Web.WebView2.Wpf.dll
- Size 80KB
- SHA256 6d329162b460515a849c693518ff626a1a3363e79d549cfd6822e5601f24603e
- MD5 d8e466f3951eb9a3d22eb098f4cced13
- SHA1 8db2e9b72d72ee13c2059371a0b3026137118b7c
- SHA512 6ea9f0ce48f5e3b31465e7dd6e7e808d590933d99242e040c28b260f9124b0f3662d7e7356798f7e9eb09120ec3900cf98277e315a783c07cacce93ce1d0fde1
- SSDEEP 1536:aU8jJ30lsivLfCoiWqhxaRkPqsfha87Y1DHfF7yEW30bpc4Jjr4YeUq+HhxU0udr:hs+vLqrThx6spa8+DHfFy30bpc4Jjr4B
- TLSH
  T109836C8193AC8923CBEF1FFD7C6050140FB8FA83B652D7992985B5EC0DA379119197A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Free/Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH
  T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Free/Mono.Cecil.Mdb.dll
- Size 42KB
- SHA256 570a437dea0271d1d5c8b7d6a408b0b2635bdb0e8b8d5051878f3e7fca087f89
- MD5 2c39a53a61168c8a7a9f53ebdad6137a
- SHA1 b10ac8325cd72c7a9018af806d75739ab862b4d8
- SHA512 d1987995bb58978a063a195a18ba02908edac02a3e7808e93f8340aa968c9bd74f76d2e6fad8158f72bc3629c1382039863471d51e510bd897187ccdabae8e14
- SSDEEP 768:wlUj6BAKp/zgvVucdcRsCVKcraB09THkPFtQI4CRIzZwMNTBczwDN:0h3/zgvVPcRrK09HkBAwMNTNN
- TLSH
  T135132A1067AD9B27C2AD8AFDF482911507F09125B623FB9B9FC4F4EB6C47B85050227B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Free/Mono.Cecil.Pdb.dll
- Size 88KB
- SHA256 50a1a1a79dc86fcfb8b51249b5325a10dd93d193c52999cf6775d25030a4e606
- MD5 5f6a2f17f4e792600a13e3771d5ca5ff
- SHA1 e411b8e51b201c5f389c2388d26735c1e89b3f6f
- SHA512 67af09a5545c6bb0e033cfa09dfc654ce4cd4d22c418402d5a43612eaa6e60b71dca2bf4f796a6027c8e7aece88d418e6e8c469c94c327f5169608e67a3e7a39
- SSDEEP 1536:TexPta15J8wWI7Kgl74TChe44tALYKXybJG3OoCkvV:TexFafB7q2hwArQJGFhvV
- TLSH
  T137937E3A9B98FA27C3ECAD7724A60D0907F1D126E153FB55C98959F8381BB301232797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Free/Mono.Cecil.Rocks.dll
- Size 29KB
- SHA256 842e09959084eda733aab1a5354d7af79e29594f4d8b91c8792103e5c755ed9b
- MD5 e136924bb4051a462ad90bd14cb0ba41
- SHA1 8cfeb4034766ce06f9216b1872703015e8ea0e09
- SHA512 1baa852ffa42fd8a743661f003b90c840276b4cd864d5467b8d551454420ea46bb6c97e0dbe832de1e5e0672eb57365332dd5f86ad1df88820300504a3b1ea07
- SSDEEP 768:628hQuem5RPkF+pXtRx/hRsPveQJcpAUdE3fF7Mtm3M:62gYm5RPv9jjsPveQCdEvF7Mtmc
- TLSH
  T1B2D229022B68CB77D6EF4575B8F0212842B1D39F6803C76E4DCC61E9A947B8567217F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Free/Mono.Cecil.dll
- Size 354KB
- SHA256 c41bdb9ffd3c5f6e17d2382c1012d73703e035e3f1100245fdd4e08c8dc6eb5b
- MD5 2f096535c228ab0d2082adfc01678481
- SHA1 0e0dcb36aa56e7f99aa524cfb3c72e4918cc5b32
- SHA512 9f54b9e85ef70afcb36569885de73bba704a8901c8ddbb5a35de6a1921d4d42f88026aea41ed77ec7a8041ee8a04efef817deda7dea0f29a716dab7a6ea7fd9e
- SSDEEP 6144:LHNGIaxcvxT+2pEwMjbLmRlQ5+A45iziJCJP+pIoTtya:RRUQCmRw4szYCOI
- TLSH
  T165747B2167EC163BCADFA37BD06B042D46F9D015638FDB8D6D84A6F91C83FA65800267
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Free/NAudio.Asio.dll
- Size 33KB
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH
  T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Free/NAudio.Core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH
  T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Free/NAudio.Midi.dll
- Size 45KB
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH
  T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Free/NAudio.Wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH
  T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Free/NAudio.WinForms.dll
- Size 40KB
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH
  T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Free/NAudio.WinMM.dll
- Size 56KB
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH
  T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Free/NAudio.dll
- Size 7KB
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- TLSH
  T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Free/Newtonsoft.Json.dll
- Size 695KB
- SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
- MD5 195ffb7167db3219b217c4fd439eedd6
- SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
- SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
- SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
- TLSH
  T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Free/QRCoder.dll
- Size 184KB
- SHA256 1fcb252a5f758d5f8af8581a9250bc2114420e15b7fee61df22289d8627fadcd
- MD5 c21af7f8f870ca63f4213724377c7e81
- SHA1 38b71b685a71f0d4511bc23d7007cd12c64b4e13
- SHA512 28f6d470c68752e1a1ef174191f367001db8087980998c3c894bf61f21e195dc99ac3d99d85c294c7b44ad9a702704fbbdb95a4e40ab5c643461dd3868df4b4d
- SSDEEP 3072:Z+ilEvP1mYrSUToLG0C12p5d8JHJTSE/YinmCyVZf1fdgDbEQElpIk05UB55uyjR:Z+ilEvP1mYrSU0LOMmp7mCyVPwiIk3v5
- TLSH
  T120048D2567FCEA16D1BF7B31E87040208B33B496B976E75F1D88A8BD159378088527E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Free/Raton.exe
- Size 15.5MB
- SHA256 17b707221e6193ffeb3551814847309c9ea1e3c43d13529199b7ddf5c82da120
- MD5 f210a00432f20bf65a37fac33226f976
- SHA1 a4b74502f411ff03630bc9a6349a8e3054bc94cf
- SHA512 d942667ca7159f7ab509bf6aa9bc1ec6f51182e77c2dd8ad24fe11fe65a0fca4bc519365c25fae52252dcaa11977e0a2c5e68a859c71c61f80566b43c5fb8727
- SSDEEP 393216:nXurGI9EP3WEVso96vyKy6X5msvyKy6X5mO779evZoJTw:nXuqA4mEsypuypw97JTw
- TLSH
  T156F6120137F3D509E57F8BF21AB1629093B3B366A979DEBD9451028869E67C0ED403E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32