Extracted

• • Target
    FreeNitroGenerator.exe
  • Size 2.4MB
  • SHA256 1d2ada12902a38c658a1fb5e81f2f7f7a1ae61dfc2ce3af62b8816daac9930d3
  • MD5 ab0a2093072aa75317bfc32c8c1a86e3
  • SHA1 4472df697bdb4707554d58676e2105a1746ad399
  • SHA512 ce3673a2f5485c695fb9717c6c73590d0a6f3db51ad9f8a3a25c174d47ac01d9c1bb3a39865aea4c3640a8053273023bb0e282be82155c2552f79a3a5e1f393b
  • SSDEEP 49152:hgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4OAn4C:hgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1E5C5011C33F9C618F1AF4BF4A47289664771FD179C52DBAC58A139AE04B6F44BA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1