Extracted

• • Target
    fishstrapsetup.exe
  • Size 16.2MB
  • SHA256 e476a1b068f473c5a2b41d19f7a397b007e20ffd8d5625bff2c4001fcbe8d140
  • MD5 56cebd3d2b9adc5660d4e70ac2aa29e0
  • SHA1 c51b532ac857a08a2efdc6fad6dbb72463fcfdec
  • SHA512 5a7513ac7275591b435eb69e40ea6349855212eb11c67248c1c20b452d2d2adf18d2a852351c5d6001ac43f946169a36d1666d7c929733d82f65470ce1e89e86
  • SSDEEP 98304:d2uRxsewxflE7JmE7FIAUxdgeTsTE7OVfasIYyFLjW/sa+ZmD3JxOYoHwfLk3vSP:pRGew1SHDUsYsPQsIjKsa+ZWObAbN0
  • TLSH
    T1E6079E8573FC2B35E3B74B35A970621A4976BC1AA911D78E2B887A1D1972740CCF0B73
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1