Extracted

• • Target
    DDnet.exe
  • Size 2.5MB
  • SHA256 1c828e78d08e1c500cf40476baa47a5e2bbf5d89520a984b7fba21bc48380aa5
  • MD5 1a55e7e2b093ed5e0fb75e9a67e3174f
  • SHA1 fe4d9fdf5bc15ee96d7ba6cd6362d6c6189483da
  • SHA512 bca6bccaba04d1b82bd64ab8da3f8bed60fc23095a2108ce1798eee34316f64855e51f93614fadec62f6c35389994be113b4b3070e376c30c398e9542b47f1c2
  • SSDEEP 49152:cdgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4O5GLhm:agVUuHjkDGjYQDGuRxzewt
  • TLSH
    T12DC5011833F58A0DF1BF0BF4A4B185564772FC569D96D76E08A5B8EE04B2F44AE10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  collectiondefense_evasiondiscoveryexecutionratonratpersistenceprivilege_escalationspywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1