Extracted

• • Target
    Loader.exe
  • Size 3.0MB
  • SHA256 c2f5d16fc8a66951988a5d81659ee66e372e9494c19a339cf6eb697847620856
  • MD5 f0587783a620c0a76739946fc5dd774e
  • SHA1 30d94f2df866e00b58dab909f002f4ee3872ffc2
  • SHA512 410f269fd0e14947734f42171763e651d3a4d5e3f6124e36f5058af7f052b065b22157e2c38d871d743bb57c5826f64527b2412b144fc077ef5a6921f21b5910
  • SSDEEP 98304:cZod9rGE5TDSkZG3klEB37BfidnZFEZmDbWQ:cZ3HkZ8kuZ7QZFZDy
  • TLSH
    T149E53376D5520EE9D477EBF09215A9CC322BD3BC27248E484F5A2B3484F3164EF86867
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionratonratpersistencestealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Modifies WinLogon for persistence

    persistence

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3