Overview

overview

10

Static

static

10

test (1).exe

windows10-2004-x64

10

Resubmissions

13/08/2026, 17:27

260813-v1w7yscc6510

13/08/2026, 17:25

260813-vzcf6avemb10

Sharing

Copy URL Twitter E-mail

General

  • Target
    test (1).exe
  • Size 2.4MB
  • Sample260813-vzcf6avemb
  • SHA256 c4deb3f5de5762b98dd03e9dbdb1d02dd3c6df3eec2bf037a75313edc5c0d765
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ratonratdefense_evasionexecutionpersistencestealer

Malware Config

Extracted

Family

  • ratonrat

Version

  • Professional

C2

  • tico-32985.portmap.host:32985

Mutex

  • OABZocEuWZG38WQDGS0kOHU

Attributes
  • assist

    true

  • box

    true

  • box_icon

    Information

  • box_msg

    your screen will go blank for a min but everything will be back to normal soon if you restart your pc during this process your pc will be ransomware and bricked deleteing system 32 making your pc unusable

  • box_title

    sorry to tell you but your being watched

  • defender

    true

  • delay

    0

  • hide_file

    true

  • open_website

    false

  • password

    t.me/junk_code

  • process_critical

    true

  • raw

    https://pastebin.com/raw/5BzQ82Z2

  • reconnect

    3

  • startup

    true

  • tag

    Infected

  • uac

    true

  • vm

    false

  • website

    https://pornhub.com

Targets

    • Target
      test (1).exe
    • Size 2.4MB
    • SHA256 c4deb3f5de5762b98dd03e9dbdb1d02dd3c6df3eec2bf037a75313edc5c0d765
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasionexecutionratonratpersistencestealer

    • Detects RatonRAT payload

    • Family: RatonRAT

      RatonRAT is an information stealer written in C#.

      stealerratonrat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks