7c987153af9d584b8d90c0e684c57267de525eb94b6804205287842f7560d83d

Sharing

Copy URL Twitter E-mail

General

Target
RatGames-Setup.exe
Size 149.5MB
Sample260823-e9gwmaxwfz
SHA256 7c987153af9d584b8d90c0e684c57267de525eb94b6804205287842f7560d83d
MD5 b34f06b4051d6c05fee3c1965ea27a75
SHA1 346cb9357a5beee9b4dee82f9ce563c39515fe3e
SHA512 cd3906b84e6dc6c07b1f9f6e0d7e91cd207c72ad2134b03d9fc51ce9197bcb8051fbb182b76735dbbbb127520cd8267171c4b431a411e31c6384aa4022c85da8
SSDEEP 3145728:8vLNGZvyqZldiU2QfMnoVBOvl+bO4p+pobfj1Dido2RgTGO5ok5LB2DV:cNGVyqZLiU1SoVUqiobfj1DCg3h72DV
TLSH
T101783325330E841EC3E6F07191973B7B9402E25C9547ABD727ACE9C901EBB8C3A5B4E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  RatGames-Setup.exe
- Size 149.5MB
- SHA256 7c987153af9d584b8d90c0e684c57267de525eb94b6804205287842f7560d83d
- MD5 b34f06b4051d6c05fee3c1965ea27a75
- SHA1 346cb9357a5beee9b4dee82f9ce563c39515fe3e
- SHA512 cd3906b84e6dc6c07b1f9f6e0d7e91cd207c72ad2134b03d9fc51ce9197bcb8051fbb182b76735dbbbb127520cd8267171c4b431a411e31c6384aa4022c85da8
- SSDEEP 3145728:8vLNGZvyqZldiU2QfMnoVBOvl+bO4p+pobfj1Dido2RgTGO5ok5LB2DV:cNGVyqZLiU1SoVUqiobfj1DCg3h72DV
- TLSH
  T101783325330E841EC3E6F07191973B7B9402E25C9547ABD727ACE9C901EBB8C3A5B4E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution spyware stealer
- Executes dropped EXE
- Loads dropped DLL
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  LICENSES.chromium.html
- Size 19.4MB
- SHA256 b911161e6594ec76b872498b423c54406168f2974e0d407a847f7de1e5ff94dd
- MD5 c8e8384bda055e42bcdc54cda98574ba
- SHA1 eb7da46ad66f356437b4e7a41be3b41c52396f11
- SHA512 c3fb288e7d25dbe61b132c81811d6d3d4deaf1ef227f1c9d8e56063c55e7204be57899f84492ad554553f21ad8642f27301e3ea12a8298247cf6dbb0a5c312f7
- SSDEEP 49152:rP2/kdNTzeM75TYp2tzwC0/J3r8xsJQnFTCa7id+Ui4WMEAcA3:q
- TLSH
  T18627B46BBB49037316F242626B47A5CAF31EA13F375A1654309CC1182B7BD2483FB69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  RatGames.exe
- Size 215.0MB
- SHA256 ff92441ee7be993567b8cde98caeee2d8534f96deceaafefb3795e014dbc22b8
- MD5 cfbf574fd3e8ed6ef9a0dada4b8a5865
- SHA1 b7327185b18b71495abcd5eda6e6de8cbfdfc94e
- SHA512 732e688caa1bf51873f4860440cd6575bc1f1a3a5488d024d8695bd24212594dc14421fbaa4c76b7e8d248ca278ce59f7306cb45997f99a5a48e5901409842c8
- SSDEEP 1572864:LOa3GJV1iPuKYncvg3LOL9Yez2OTe1lKrnzGjxuJm0p6TQLCfTQFHk4KmntuykG0:6ximKYn2KwgF6V8
- TLSH
  T1F1B88C03F29641DAC05DC1B98B5A9633FE71B8454B24A3DF2B5447522F66EF82B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

spyware stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  dxcompiler.dll
- Size 24.4MB
- SHA256 56a29f483555dddbefb491aa470b8c5c268d66a149892a8a40a582f3e92b1895
- MD5 a76245b31c55ba550eb8c4f8994b55bb
- SHA1 0d09b098d00d58f0eac2598100e64530c7cb5f51
- SHA512 0ee0e7094048836432d9521eb67a9b44cbc2fc91bc7363419a907993bbfcace463e9298837b1d7d6d954f425c70221e4ff0333f587aae0c78a80470564c42f27
- SSDEEP 393216:r2Kz8w0D063Lp8Fj6XHMy+A4joAPKxVbQ6nKOwx0u:l63ZMOAsbQkwxr
- TLSH
  T1FF473A122646D49DC099C879C7678B268A2C30E73FA7B9EFC0F451212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  dxil.dll
- Size 1.4MB
- SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
- MD5 c9a7241ce83437d54a82522aa0b54575
- SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
- SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
- SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
- TLSH
  T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  ffmpeg.dll
- Size 2.9MB
- SHA256 afb4f083d34c470bdafc6d1d3801142ea2a71b76553329485d91a35534c086df
- MD5 758121e17b53b20cea0e8578aa97d2d5
- SHA1 73d93e63c79367403c371cb41b05feb286d9a300
- SHA512 109b4d100d354197ad1602fe01f7839dae924e299d2b98ab0b7eccfe9495c4dfeeb35335d6439ae2233e810f4ce36575425cbe1eb315ffe37c8331ce30cc3b69
- SSDEEP 49152:9/QNVdw4YesUuZLJPbdzKKtBr4ZjB+WRBxtqYaLueWUekYi:9EibUuZd2BDaLueWe
- TLSH
  T13BE5AE02F6D251EDD019C034979FA223F271780A4F206AEF17A05A253F66FD86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  libEGL.dll
- Size 463KB
- SHA256 a3b40bb99acd821d955e4a26555b43efe12bd98056a8b7693be0e63b9ed53910
- MD5 52302be380554804103583f20f202a6b
- SHA1 b8888e727be563fb3a018fa5a9372ca820e69054
- SHA512 20e0936b4a8037a7aba89cae3fe83d9af804b3ef1aaa42857b60ac44f766354b7759fe8073c92f75414fc845c60404d4fe89c6d996da83ba6fe28b728962b4db
- SSDEEP 12288:qr6jqPQTSyEiM/bacC7g3pOvMVr5LsMQF:qr6uPU/P0Ow1W
- TLSH
  T1FBA47C15B3E549B9E07BD1388A538643EB71B4560B61FADF03A0D2392F77BE45A3A310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  libGLESv2.dll
- Size 7.7MB
- SHA256 01eeec6f3451d5981ce883e9ec7a346c96173bb58854c5c3f3452e1637fb6d6f
- MD5 9a07bdab9cd3bc4431a2a4930e7d7478
- SHA1 5a390de108cb1fad7a953ef6b8272a6eabd01e29
- SHA512 3bb943449c519107a698a777a9a42d950cfb9c6916c2e07f7735ed91cdccc5b24cf0767b30a84bdfdebeeb7dee7d397fb30103518b1b0a939785868ef1610e41
- SSDEEP 49152:xuFelYCvA/IdNaQJ9EcYQOL7qOd6Me9CrdOZWznqOEWXGnb2NYvbCzaoBnYRZbT6:gFKvkcc6q+vKlMTPA9mp9Qh9TUIWu
- TLSH
  T140867C03F69681D9C05DD2788767A223FA34B8450724F6CF2AA457152F6AFF0AB3D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  resources/python/Lib/site-packages/_cffi_backend.cp311-win_amd64.pyd
- Size 175KB
- SHA256 0b5c05bf3e9da14c33566d2c546fb7618ac7fc2b89365a66cfb1082ffe3d898d
- MD5 87c57ea3f34d4226c596eb64f72763e7
- SHA1 4226786006bc8c924790bd770d07ab3634a6452d
- SHA512 2058e5c248cc7deca4d0cbab8ad3ae22ee7baaa2ebdf8289dd03ca7c1c888c8a1580b86cf3b1c017c46c660e0c2cddd4c4b40786bb176d0e043245751ec5f2d1
- SSDEEP 3072:kWkpON4k4KPLiOVX+ARhbUvyT2z243Zy5FthZQ2P7RFSTL7Ko3i3gA2Q:krKPLTVRhbUvyCz24sDFFSTLO8Sg
- TLSH
  T187046C5A328C11B2D6A6513886579B53F3B3B460174197CF01A0C7B52F1BBEA7A7FB80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  resources/python/Lib/site-packages/_distutils_hack/__init__.py
- Size 6KB
- SHA256 ced72e54431ecf2d8d7dbd8a1e27724f1b171af3ca1503c304bf11c59a7fe861
- MD5 e912fe96df779359bf6746580f019644
- SHA1 8bcd1183f1544fff8a04485304c434f0300acdb6
- SHA512 ea0495c3b02874b58806758425351b40723931ec7fad50dda15b5eed3e377ff77a4add2eaaf012b7e0339f6db9ceff8ac1b8736cb160e8507ef73d8ac49aa148
- SSDEEP 96:cnuPveem/bGmdx9pJHPrGXwiE2fXsfnCUy01LOq6LIrqCWPANPuqlTl7Frw:cuPGJ/ymdnppKEk0CNsrqoWel7lw
- TLSH
  T1A6E15233C8635C8247C7C1F45A87E471FBE558930AB06938BDED42A82F995E0C9FB5A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  resources/python/Lib/site-packages/_distutils_hack/override.py
- Size 44B
- SHA256 12efecf8d17a5486780aa774b5b6c0e70b56932d8864f35df1eb7a18bb759b3a
- MD5 012a3e19d518d130a36beaf917a091c7
- SHA1 358f87c599947263e8adf079cb2131a522876af8
- SHA512 76d17c1246b920b7e71f196876a2fcd6a3e102f10933cac558dd993b6aa794766d657b85e0a7e56a71df5f14c2f95a9e6576d81163509bb42dec0fc0e49b9998
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral27 behavioral28
- Target
  resources/python/Lib/site-packages/_sounddevice_data/portaudio-binaries/libportaudio64bit-asio.dll
- Size 335KB
- SHA256 e38618a0cb83a0287bee3b8bd68a710ae0d34178217ef4fa21ed56f765111943
- MD5 bca1571f8292cc868d52111377b1189f
- SHA1 998d4c70088776530ad533ff564bd65cdf482b6b
- SHA512 646f667e9b412da73baedcf53e3a0136f9e7faa23884f2fbe838d6e102a471358b81ad47b034a4e472353ccc9456a83bd5423dbbffea5f0a1082d53c38da5344
- SSDEEP 6144:udKnQ2eySLTsUuJmKhhXR+HGgT56xDDo9AilvoYieH:uonneyHZJmG+Jd6xDMAit
- TLSH
  T1B8747C55F3E418F9E0678178C6B79606E6727C1503249AEF27A086253F33FD1AA3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/python/Lib/site-packages/_sounddevice_data/portaudio-binaries/libportaudio64bit.dll
- Size 300KB
- SHA256 ec080194f01e4095c7fb43dbd7ed05af922c5b34295056a9ff56782741d65481
- MD5 8133406e00f77d92ef0f98898497464c
- SHA1 a6018e9e2360e5b839348f8d82036b2da419d61d
- SHA512 1031f4fc33695f5d4950aad2aae0ff1a40d8d8c7ca5925d211429dc170d64795594b34dbfe43381e3878e269db4dc0e4342a7e1271ff9098c8535fd51876d828
- SSDEEP 6144:a8gPt7TDF1aVcnUnmb0OsyIXjcJaovrTvoY1CI:anP1VUnhyIXjAvrh
- TLSH
  T130648D45F3E514F9E067917CCA679606E7B278110324DBEF17A086263F23BD1AA3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Reads ssh keys stored on the system

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Reads ssh keys stored on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32