Analysis
- max time kernel
149s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 01:09
General
- Target ratonClient.exe
- Size 594KB
- Sample260806-bh72ysfa66
- SHA256 38f2b9f885ece9b8c2087f29390e88fbe7c621dfd6b2ea4e03caa42297b10744
Malware Config
Extracted
-
ratonrat
-
Professional
-
72.31.21.20:55650
-
d3qOmsSHnXMiRTaX0DdbFVF
-
assist
false
-
box
false
-
box_icon
Error
-
box_msg
I'm the message box description
-
box_title
Hello World
-
defender
false
-
delay
0
-
hide_file
false
-
open_website
false
-
password
t.me/junk_code
-
process_critical
false
-
raw
silly21
-
reconnect
3
-
startup
false
-
tag
Infected
-
uac
false
-
vm
false
-
website
https://t.me/example
Signatures
- Family: RatonRAT
RatonRAT is an information stealer written in C#.
- Detects RatonRAT payload 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4836-0-0x00007FFC1405F000-0x00007FFC14060000-memory.dmp
memory/4836-1-0x000001D1A8F60000-0x000001D1A8FFA000-memory.dmp
memory/4836-2-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-3-0x000001D1AAC70000-0x000001D1AAC7A000-memory.dmp
memory/4836-4-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-5-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-6-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-7-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-8-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp
memory/4836-9-0x00007FFC13ED0000-0x00007FFC14874000-memory.dmp