Extracted

• • Target
    not fake_protected.exe
  • Size 2.5MB
  • SHA256 1a9fc8492eabd26832e92d35a5836cb1aa884c19a2d8f2318f4b7f969a705ed4
  • MD5 2d360671fe0ccd897a843217e0e938aa
  • SHA1 677583e0c68173f91e3f6e717cc47c9cb27a42b4
  • SHA512 44e6b41138ce118019f14a4285d7062933fc1ee37a5546be52b0c4150f24c42e5032f2988ff172458e8624c6de5fe3a707d9f2cca37dc7f94dd60a2c887846b0
  • SSDEEP 49152:sZ7F+Z65sew/K1rSjDdhixowkbE4aFcWOYgYr2jNclDRT7E7N2l98fCqlZ:sHasAK1+gHkg6sgYr2jKuN23v+
  • TLSH
    T13FC51257CA7599EDC0AF2573FC1A6D8F6BD8B5E2A8B8C58BF48C041641B298D035F381
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2