Extracted

• • Target
    ratonClient.exe
  • Size 2.4MB
  • SHA256 940a9c1cacdd1954ccd8545cbf466c63341b4f418182c28a2defbf7acefe5882
  • MD5 6644b92524a85c5ab0330b3b5efd1c18
  • SHA1 cd39f4c90532d8bf3ced0c12129ce345f57fce20
  • SHA512 81423eb38e627e6531f1c62ddd9b55dd575a7fc53f9e03268b9c3168cb28d3e762440df0ef34d445d07edce0f91bc5d7fdc6c33d1aca6b518c2d4667f1773b69
  • SSDEEP 49152:dgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4SAn4L:dgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1AAC5011C33F9C618F1AF4BF4A57589664731FD179C12DBAC58A139AE04B6F44BA20B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionratonratpersistencestealerdefense_evasiondiscoveryprivilege_escalationransomware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies system executable filetype association

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2