Extracted

• • Target
    setup.bat
  • Size 470B
  • SHA256 2a858477372eb1874a8643125d81e81df777012bce8c7702946f37c9655a5fdd
  • MD5 2ba4d59b7b64f1fcc6615ea1bb9db836
  • SHA1 5cb46f05e959dad2210be754c1cb2c1a9e05ba84
  • SHA512 613ee7276a111e47f187934097b73762bcf17c678b7bbaa368344326809092047ded3f592e68a73afc4b41526569a7a44f87c19d99cd7378d3c0d19011f3095a
  • TLSH
    T1F2F027920597207E9B394DD8482B0F0DB89F52A957AF49C33138A41C4A09E4AA6FE858
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2