Extracted

• • Target
    rat.exe
  • Size 2.5MB
  • SHA256 e14bb83f6f8e7493ea61d1a9297fd39345cedf41e4b5047ee58187ca4d2c716d
  • MD5 5bdcb34e0c0a849d782cb41ed5076dfa
  • SHA1 f3f923c2518f2f29684096b3ef47140f4a62187b
  • SHA512 39d6b35f6f5174473fa4e1f780949bd7231ca5c4e3ff5c352afbf0bc75cab651028837cfe0639db5c868993c9a4aa924ff40047edae1ea7fd8d410fab58016f6
  • SSDEEP 49152:XwgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4u/HGu:ggVUuHjkDGjYQDGuRxzewz
  • TLSH
    T19FC5011833F58A0DF1BF0BF8A5B149564772FC168D96D76E19A5B8EE04B2F04AE10723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistenceransomwarespywarestealertrojan

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  behavioral1behavioral2