Extracted

• • Target
    notepad.exe
  • Size 2.7MB
  • SHA256 94099cdb75602d3170ac274255e8ad7392693ed7423f6bbf75c705bf7cfd832d
  • MD5 8c05e5af3ba7a6cb2da6145505b3ced7
  • SHA1 3ef41fc1c0558d8d08ed29364dcfa1a4366dddfb
  • SHA512 fd57bd6305ff6432e40749419eeea42b38e6f47153fb6b173288887114bd6b0b78cc996bbe9e7276043a5b75b6467b76e771087ab0f82d5507f753261ef0301c
  • SSDEEP 49152:6agVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4FKN/:RgVUuHjkDGjYQDGuRxzewh
  • TLSH
    T1A9D5F14A73EEC31BF17EC7B851714C648D32EF67E491E26966E0254E4062F80A6F6723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2