Extracted

• • Target
    not fake.exe
  • Size 2.4MB
  • SHA256 efb8cfdc7ab8b61af5870bfb326420d88a16cea7741cbcd4771dd91de1753c79
  • MD5 83067f57ebd30f61bfd4dfc79e8a7f67
  • SHA1 72b610971e110da6aa1f1c8571023cde30df89e4
  • SHA512 c17a8d7d4d7a1d7700b2e37cce179e081afa7dff231cff45e0181d5d73c61a4fed3ca91337d404b59c366cdff230e35f8dbc3b6bff0e1f572d5d86aa420cebfe
  • SSDEEP 49152:cZ7F+Z65sew/K1rSjDdhixowkbE4aFcWOYgYr2jNclDRT7E7N2l98fCqlZ:cHasAK1+gHkg6sgYr2jKuN23v+
  • TLSH
    T1E9C52366CF35CAE9C0EF2575FC59758F2BD892F1A4B8808BF88D046186B6990036F385
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2