Extracted

• • Target
    ratonBinded.exe
  • Size 11.9MB
  • SHA256 d13ac483eba31885fe6d7eff5c4c26de8a0a1542dac420ab7654e15f522286af
  • MD5 c0b0183032fa35540a9ef1ac994bdd7b
  • SHA1 bfa1b783309db182a56c41af7f1428bdef46e5b8
  • SHA512 ff63ead48fdc863226f4f639ebfc15d123fdf8d336bf89ae750ee56248aac3c0272a61a00037a7dbbacaeb960dc4e9dff8b7af4cfa6f9d4551f14e96e385c00d
  • SSDEEP 196608:GLgVzHASj5zRJewIfgGgam1z73iv1TgbUvnt/rJ9C1td:8IHL1JFI4Ggam1z73iv1TgbUvnZJ0/
  • TLSH
    T13AC6AD15A37800D8D4ABC2B8C7465653D771784A03B0ABDF0A90AEE52F37EE51E7B712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistenceprivilege_escalationspywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2