Overview

overview

10

Static

static

10

BoostV3.exe

windows11-21h2-x64

aforge.dll

windows11-21h2-x64

1

aforge.vid...ow.dll

windows11-21h2-x64

1

aforge.video.dll

windows11-21h2-x64

1

costura.dll

windows11-21h2-x64

1

microsoft....ry.dll

windows11-21h2-x64

1

naudio.asio.dll

windows11-21h2-x64

1

naudio.core.dll

windows11-21h2-x64

1

naudio.dll

windows11-21h2-x64

1

naudio.midi.dll

windows11-21h2-x64

1

naudio.wasapi.dll

windows11-21h2-x64

1

naudio.winforms.dll

windows11-21h2-x64

1

naudio.winmm.dll

windows11-21h2-x64

1

newtonsoft.json.dll

windows11-21h2-x64

1

stuff.dll

windows11-21h2-x64

1

system.buffers.dll

windows11-21h2-x64

1

system.memory.dll

windows11-21h2-x64

1

system.num...rs.dll

windows11-21h2-x64

1

system.res...ns.dll

windows11-21h2-x64

1

system.run...fe.dll

windows11-21h2-x64

1

system.sec...ol.dll

windows11-21h2-x64

1

system.sec...ws.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    BoostV3.exe
  • Size 2.8MB
  • Sample260823-vthe8aydph
  • SHA256 0f661a97f8e5dc26fefc907ca0c5a3b7b65af8804f99a4ab8894f9b7206ab45b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
ratonratdefense_evasiondiscoveryexecutionpersistencestealer

Malware Config

Extracted

Family

  • ratonrat

Version

  • Professional

C2

  • 158.174.50.97:7000

Mutex

  • UBoZxF4CsESFrWjP4HMNNMK

Attributes
  • assist

    true

  • box

    false

  • box_icon

    Error

  • box_msg

    I'm the message box description

  • box_title

    Hello World

  • defender

    true

  • delay

    0

  • hide_file

    true

  • open_website

    false

  • password

    t.me/junk_code

  • process_critical

    true

  • raw

    silly21

  • reconnect

    3

  • startup

    true

  • tag

    Infected

  • uac

    true

  • vm

    true

  • website

    https://t.me/example

Targets

    • Target
      BoostV3.exe
    • Size 2.8MB
    • SHA256 0f661a97f8e5dc26fefc907ca0c5a3b7b65af8804f99a4ab8894f9b7206ab45b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionratonratpersistencestealer

    • Detects RatonRAT payload

    • Family: RatonRAT

      RatonRAT is an information stealer written in C#.

      stealerratonrat

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks for VMWare Tools registry key

      defense_evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral1
    • Target
      aforge.dll
    • Size 17KB
    • SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      aforge.video.directshow.dll
    • Size 60KB
    • SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      aforge.video.dll
    • Size 20KB
    • SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      costura.dll
    • Size 5KB
    • SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      microsoft.win32.registry.dll
    • Size 22KB
    • SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      naudio.asio.dll
    • Size 33KB
    • SHA256 504dd507c34817a8a8be1965e82dd091ff0f5a85ba444ea784783f196677bfd1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      naudio.core.dll
    • Size 183KB
    • SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      naudio.dll
    • Size 7KB
    • SHA256 5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      naudio.midi.dll
    • Size 45KB
    • SHA256 7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      naudio.wasapi.dll
    • Size 176KB
    • SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      naudio.winforms.dll
    • Size 33KB
    • SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      naudio.winmm.dll
    • Size 56KB
    • SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      newtonsoft.json.dll
    • Size 704KB
    • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14
    • Target
      stuff.dll
    • Size 12KB
    • SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      system.buffers.dll
    • Size 20KB
    • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      system.memory.dll
    • Size 138KB
    • SHA256 bf3fb84664f4097f1a8a9bc71a51dcf8cf1a905d4080a4d290da1730866e856f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      system.numerics.vectors.dll
    • Size 113KB
    • SHA256 1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      system.resources.extensions.dll
    • Size 78KB
    • SHA256 b69c9547c7bf0d6e357993d41228b6cef033f4f2e0ecba9f07325c7e980139ae
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      system.runtime.compilerservices.unsafe.dll
    • Size 16KB
    • SHA256 70868cd40021b6df1195ba764a6672d8e19ab58b86a263992986361f316a51ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      system.security.accesscontrol.dll
    • Size 30KB
    • SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21
    • Target
      system.security.principal.windows.dll
    • Size 14KB
    • SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral22

MITRE ATT&CK Enterprise v16

Tasks