Extracted

• • Target
    ddos tool.exe
  • Size 594KB
  • SHA256 7210b7ba643efd3799d548276999e7086ab0fab8a93395ff7d7d35ce31ca7143
  • MD5 e0542d2638f87fa53001704fb25936bd
  • SHA1 d269b67c5c1cccceca84c1d8c86fda18507e99c2
  • SHA512 bccba4edb1fe77874b5d0669903702d1e3c4c223c47035129e83ad5981624562dcdf9f7af7aaa2f43adecc016d5a1f984ef62926edc0b0f89fd9f3b6ac394e45
  • SSDEEP 12288:UBaR3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piIxjQ:ZL4kkA7lXkXDDuAOFhWSApiD
  • TLSH
    T10DD40208A7FC3715E6BE8B3E59F090480FB2B2534A20E61C5D83D4AD1675B82DD64FA7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuradefense_evasionexecutionratonratpackerpersistencestealerransomwarespyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Renames multiple (147) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2