Extracted

• • Target
    ratonClient.exe
  • Size 2.4MB
  • SHA256 beb43ff61fe6eeb97da646bdf2ff5854ddaac0d5150e0679041efc352e81df10
  • MD5 82395c5cebe7fe0b8047fff723a57e9c
  • SHA1 6243b5ae94cfe71c4b4f1ca2b5fd45068104ebb5
  • SHA512 e751e5a504781eb467b53377afb361bf42a09dc52725fb5ba5b72f86bf33ea4646bf28772c78dc2940c1f9a532fc6c054eb39f942247b01684ef0125bcc537f7
  • SSDEEP 49152:WmgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4FKu:NgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1ADC5016833F98A0CF1BF0BF4A4B149664B71FC079C96D76C19A579DE04B6F44AA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionratonratpersistencestealeradwarediscoveryprivilege_escalationransomwarespyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2