Extracted

• • Target
    Built_Stub.exe
  • Size 2.0MB
  • SHA256 1a776cdcc854b4a0f76dfcf77b19ce032da858c69f592e9bcda6e26de0d23c09
  • MD5 c60916082d6669b88dc2f7306aa2dfd7
  • SHA1 d042ddebd67b4701d2b10650c5a325b0a0920bd4
  • SHA512 90b7472504e9fc73256a72ad46318ae54a407cf95750395e8091024fabeb3249bfbe5bae88de11de2af787c75c2764713bcb6c52ed9a3a7964412040667ed021
  • SSDEEP 24576:s5uYyQO8hVDs/5IdhtQFujoh6m6vBsZZ5PXQBJOKdkjnoor0PfSIgZlHVvtRJQOh:gno8haujVsPAB8KY2+Bz+2
  • TLSH
    T17AA58E46B3A501F8D477C078CD466217FA72B4041774ABEB55A08A6A2F33FE13ABE315
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionsiriusratpersistenceprivilege_escalationratadwareratonratspywarestealer

  • Detects RatonRAT payload

  • Detects SiriusRAT

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Family: SiriusRAT

    SiriusRAT is a Windows RAT written in C++ with HVNC, offline keylogging, and remote desktop capabilities.

    ratsiriusrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2