Extracted

• • Target
    zenon installer (1).exe
  • Size 2.5MB
  • SHA256 3c8a78c73ffd69030a58f76e851d954c7a4d80cc8ecceee46d6b4ad33b23267d
  • MD5 22b4e39947b4eff873ee717019b54f26
  • SHA1 358e272445c2a37791f0100296a801b58316f311
  • SHA512 d302c4820defa3b9dc9bc31b8efaffc3138c1e877aa43e13f3fe517853e9b9d13eea73c9ff598843ed0e65eadd9d1875c8899e0ecca37432743eba15a352ec59
  • SSDEEP 49152:d/gVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4OK4L:ZgVUuHjkDGjYQDGuRxzewV
  • TLSH
    T15FC5F15873F9C60CF1BF0BB5E47189A64B32FC079D96D76D18A5799E04B2F04AA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistenceprivilege_escalationransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Renames multiple (122) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1