Extracted

• • Target
    CapCut.exe
  • Size 2.4MB
  • SHA256 a0c226f33ebbb6c1f69963efa961e20582537af82f37b2ab4360e49ae1a48163
  • MD5 dd39da54a112e1917c5d7068e6bb2a59
  • SHA1 ecd59943a4b6d6e2e1987cf3ba42be9ac720da85
  • SHA512 aeea7f7ec0d93b250a3c29b027eac74af61ea5d064eac1342f9f3817ed00c96eeaec491834456d145cd0323bfd85bbbf145bb1607687ed1593480619ae776bb8
  • SSDEEP 49152:q8gVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4CKP:DgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1C4C5016833F9860CF1BF0BF4A4B149664B71FC079CA6D76D18A579DE04B6F44AA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealerspyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2