ratonrat | 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e

Sharing

Copy URL Twitter E-mail

General

Target
kwdld1.zip
Size 162.0MB
Sample260930-bkllqsz1cw
SHA256 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e
MD5 bb6831ec60cc473bc401b780779e6f43
SHA1 d860c3097e6b308222f41fedf5fd89f1d1cece3b
SHA512 ceb3c0b4380fd1715e8f6fb0216d7dd1cffd274743fbfe33b4c9deba8fc89ccb52b8ba1c499d10c5e881c2482143e23ee0253cd32d759c5da99a594d98a2f1be
SSDEEP 3145728:629GOOUdnrYdXS59QVOgZrQYtH61zxBi7+PMfO7upd4Pl0CaD5cYnUP95W:5ghancM59MOgZV61Vg7+UfO7GICpFcVs
TLSH
T1438833D1089618AC679BF8BEF37B82BD292D50BB30E6D9C50EB546821F86C455BFD403
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

Professional

192.166.82.131:1488

Mutex

QuXBDOHucYTZbvkiebLPAay

Attributes

assist
true
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
true
delay
0
hide_file
true
open_website
false
password
t.me/junk_code
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
true
vm
true
website
https://t.me/example

Targets

- Target
  kwdld1.zip
- Size 162.0MB
- SHA256 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e
- MD5 bb6831ec60cc473bc401b780779e6f43
- SHA1 d860c3097e6b308222f41fedf5fd89f1d1cece3b
- SHA512 ceb3c0b4380fd1715e8f6fb0216d7dd1cffd274743fbfe33b4c9deba8fc89ccb52b8ba1c499d10c5e881c2482143e23ee0253cd32d759c5da99a594d98a2f1be
- SSDEEP 3145728:629GOOUdnrYdXS59QVOgZrQYtH61zxBi7+PMfO7upd4Pl0CaD5cYnUP95W:5ghancM59MOgZV61Vg7+UfO7GICpFcVs
- TLSH
  T1438833D1089618AC679BF8BEF37B82BD292D50BB30E6D9C50EB546821F86C455BFD403
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Release/Bin/Decompiler.exe
- Size 9.4MB
- SHA256 fb5c5e11296f8cd6b552aa03daf760d99a380077ff92ba657d4d956af5f3d0f8
- MD5 a109790efbe0542dddf63ef0415dd508
- SHA1 34d3f0c57dd5359f21bee246e00ee01f69132678
- SHA512 a148f1b6a5423147651ab12fad0250ff000efb605e7d468fa45d1e1c1bba71bf2748741d9e62aa72228b9e674d3766d736df64e81b85c9d441e840e0bed75d7f
- SSDEEP 49152:AhW7+AqGnMYHZi0h/tipa/lZ9dco869rpyd8cuIhwSt+AOaQXkiShcwaPJXqlExR:UkDPUKXmtGYGz2YhN
- TLSH
  T124A6C62A676960D9C1BFC07892839F22BD21749D073977F7898182692F20EF87D3D764
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Release/Bin/erto3e4rortoergn.exe
- Size 6.4MB
- SHA256 5af1320434839d7d191be426f702cd048f453afa61e8a22cce50af53b1ab1132
- MD5 0fb44fb0194b8fc859316a91e2863db8
- SHA1 fdab0b829b38be9f2ccc3cf64f3c35bed8764580
- SHA512 4290da38fe0544d94c2363d51a66227ec504dd445ff3304291040c0ca46e524e78c35da318299dd717a2203135686acb099849b7e6ae51e10aaeebf6ee31f8a3
- SSDEEP 49152:hNQmQohvHJo+j+bGAqZIsFCdLLoNt6aeRxIUCHGPuARh/qNwffAj3g/bTqSk6hIg:hNQt0Ro1xdLvkGua/lgQ/6STeNS/5N
- TLSH
  T127663C1FD1D57384C80A20356ACE9633FAB27D457F25D6C7428262AB3D5E8F86E78321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Release/Bunifu_UI_v1.5.3.dll
- Size 236KB
- SHA256 f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf
- MD5 2ecb51ab00c5f340380ecf849291dbcf
- SHA1 1a4dffbce2a4ce65495ed79eab42a4da3b660931
- SHA512 e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b
- SSDEEP 6144:SIQpxILDXGGMO7Ice9C5kQw2hWHcHTykhb:SIQpxILDXGGlET9n/cHG
- TLSH
  T19D345B1137A88D6BC67E4BFEA4A40240D7B2F956B1DADBCF9D9510FD24C33664B02263
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Release/CefSharp.BrowserSubprocess.Core.dll
- Size 1.3MB
- SHA256 8036743bf0935fca5fd46877dd2b4c160d4f2e618db9c9a8fd72b1f7aa37ba6e
- MD5 557c3c1290e487e004e6d70b8847c053
- SHA1 7090c09d4e30b508ece6fcceec116650626cc547
- SHA512 a0bc4e5a9a417d608c081b63d63ff597b2105bdf8a9ecf1a9471b208501d47c6cd4e8f1c2457bd646a809c8f66dbdac672e00458de1e5f99c98174f5df14663d
- SSDEEP 24576:6bz67bETiD+Ke0AceCJ2ZiVwhEDssQjPc8DnXoSiW+Yfrx+8Fk9JF:6H63Q0+Ke0AceCJ2ZiVwhEDssQjPc8Da
- TLSH
  T1A6555B28676505A1D3FAE27E80938A96C2F37C06A325DBCB8519D3511F9B7CC81BF235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Release/CefSharp.BrowserSubprocess.exe
- Size 6KB
- SHA256 81cf07a942f86e90fa484080d0e4d70c17dc5942374300ba4a0444119a8cbb35
- MD5 30e5bc5af6df7e47ee6f19f5e0fc22ae
- SHA1 3d41807dac87b6e014181b68af3888068fe989c6
- SHA512 af15a195df6de6ded8fca0a742dfcf1d5a16812e05c04377397b38e43812fa5f6b4953b19612e157d89e9c5359135622fcbfc9569f77d4f93254ce9d91eb858f
- SSDEEP 96:56Zx3PI7kxmQBDv+Vk3NeFZpetmAqNt61OYcXe5U:CfIymQB6G3NeFZDsAYcXeS
- TLSH
  T1A6D1B35083E85362F7B702B678375741AF72BB63A84B47ECB44C424A3F2A690CD23257
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Release/CefSharp.Core.Runtime.dll
- Size 1.9MB
- SHA256 461c4c255b3e7166a1ebad9c59ff2af2ddff754866055dd3aa3491a02109dff7
- MD5 46818fd3211dfef1c6be11b2b19094f7
- SHA1 581073d7bcc5dc0b4b96b828f6dbf45bdea270a2
- SHA512 3d4df1af428e57fd637695dbe79958969e6fffe2fdf92f743db8e79ac52c520e633907ea6d121a7c392edddabe2c551df4938f88cc6a9ca00e85fcab004ecc32
- SSDEEP 49152:AylEzM4UKpldqcHCnrZi54vEgi/sA1W1akqc8QI89SyNWYxtYtUkjCpf162gQkAp:AG0Y
- TLSH
  T17C953B29736A1A11D67BE33E80630752C273A805B35AD7C7A412E3252F8B7C4A97F71D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Release/CefSharp.Core.dll
- Size 1007KB
- SHA256 07f3600289fd3e9a848fe99b70f5eb404c14fcb2ff221dcd117fa63c5df007b3
- MD5 59a5a5c5134188f46632067d55a70cbc
- SHA1 f0e1cfdfcbce46b3f2ff1919d7f8cf8783443b96
- SHA512 be47ed23039a0d66a227fc7b10409f778e6494041f3c529bdcf9ab5ad4f51f07f2c85c6401fc01e70213d0a5ac8bcfe8c7757a5eac7bbd8f37eb0137def42c97
- SSDEEP 6144:sr4nBZdzUmkR9YtANFf76YpeMHXCdr9EQb2CkrMtBvkuYIcWLUEyiYDauxqEqZBw:sBj3FTDe7UEKVqxGvwBnxqdwZB
- TLSH
  T15C25D63B3BAC9ABDEB9A0571D13347256970E1C63756F3A487B2A4F83C05F9049412FA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Release/CefSharp.WinForms.dll
- Size 53KB
- SHA256 49a4c5ec4b9d7efa7ebec95fe313c11ae1ea2d8baff7f9c21e05d12d8b91846e
- MD5 bede011c035b5b7644ca68210af9da92
- SHA1 1acf30140c0fb4d14f7c79f12dfa80f3133ef1b7
- SHA512 01f13f609e12c52407ea58a66e8cb2517ce6baae6254db1c035bc7770897eaa0cc5b4e34a58a2a54fb1ebe36a299219543c06f28c4969e2e9d935c9edc12cd25
- SSDEEP 1536:G73KYuiYzl4xR6UDQvKCHVkmJOpUAiNmhEwaD9:GnuiYkR6tFVkmJO2A4mhEwaD9
- TLSH
  T18E33091253AC9A37EBEE0A39A43015511F72FE03B996EBB89D44B1E61DB73D04D403A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Release/CefSharp.dll
- Size 275KB
- SHA256 98310f8134b110bbd344e57c37c3e2ead3c92e536f42067cb637f81380db64ec
- MD5 449dd4026369e89310055e98fbd80af8
- SHA1 28879a6c8b32837dcd2d6a19afd626b7d9f4c74c
- SHA512 3075007eba8b7c2d6579f471ccacd8cbf1be874da73c0881502176af6f6a7f6603ee097c5cf3d6cf21b2e2a3b14bf833811d3100520ff266fea74a3cb61085f7
- SSDEEP 6144:XnlRpBivtjue9t63ggd+ir5gf5cfurw+pmdmF:ficLfdyfGurk
- TLSH
  T1F3542A1263EA9975F5EF4A3DB8B11A27463FF809B031E76D4F08169D2A93B049C50B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Release/ScintillaNET.dll
- Size 1.3MB
- SHA256 ad0cc5a4d4a6aae06ee360339c851892b74b8a275ce89c1b48185672179f3163
- MD5 9166536c31f4e725e6befe85e2889a4b
- SHA1 f0cd8253b7e64157d39a8dc5feb8cf7bda7e8dae
- SHA512 113a7b77d2d557d135470787deead744d42f8292d853e2b55074e9cb3591fd045ffd10e5c81b5c15dde55861b806363568611e591ae25dcb31cf011da7e72562
- SSDEEP 24576:IJSShz305vgNF7/cOCPHPSVs4Eq+QTNX+cfQdS+2MMPishd/Ws5:ti0aNvoHqs4L95X+cfx/HGC
- TLSH
  T10F5512117689674ECADC6EF3E56171684BFCC183355AEB385C49A4B6014FB800EFEA72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Release/VelocityAPI.dll
- Size 16KB
- SHA256 dd349e62a6727eb9b923e318b4ec21f5beb9d8529bb6182dde781fd2a33921f5
- MD5 845bfdd8e105abc07cd3132792dc4a0b
- SHA1 f560c015b9a8f9cd94acde1edfd9a84123f8e624
- SHA512 b26810a2f15d29bedb6a0a6092d34736b328486f4700ea785d1101931133571da7a1744a9adc44727a8e98113dc44c1a1a4f9bea0e157859279bbd71df18aa0c
- SSDEEP 384:cvW9vQvW98Bx2/Vq9qAh6eJJIKhLuP28fQEQ+aMDsy:cJBcMZjZyTfsy
- TLSH
  T157723B0ABBE8C666E6FF0A757DB2060047F2D615BC21FF4D6CCA745968633450A1570F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Release/chrome_elf.dll
- Size 1.6MB
- SHA256 b5a31cf90a560d0ce10d2edb495844a197b566d6a3ba08d8820bac9a58e58b94
- MD5 7f33495edb97a0218fa591e217e1e6e5
- SHA1 24eba6630cd94dda75f0dfc495a076843eb08fa4
- SHA512 7f4a5e56b36efd527c598cafdfc5b75ae10b1de30be8abde4ac113bfa6bf4a6b99162f1322177442ab097e2a1e822cd53e29b47b3e590a8aa2436647a34d4b23
- SSDEEP 24576:QxGJzUDCsOz8XAa5dx+g/9Kgz/HZDShgWkbWOmvgRvgTGtV7np:QxGiCfziAidxj74uWOn2StJ
- TLSH
  T1EB856B13F29940E8D05AD1B887578632EAA27C460F34B6DF0790B75A2E7BFE46739710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Release/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 7120a30bf96b52842a21a9ba0309ad6e591d47e1829af88aa01cf21b956a3e3a
- MD5 80b417ac3c092d61d07045201a5205f7
- SHA1 1a7bf2d6862256d49279aace53df0e0a0d65992e
- SHA512 221a0d526983d7b5ada14a0e14a1371826a46c50239a765a06f60dc54729c3e56f30910ed76713fb379eb9546296f763bcb47b599d4819bef29e9e4299941571
- SSDEEP 49152:DWgqT7zAEQ49/NnW+xnPNHD1+0MMT3S62DlsqzTiK1QglUQDBg0VCXSLFOFZDj+A:qDzf/lzj/G6W2qnVZpDnUL
- TLSH
  T169268C5767E840E9C1BBD238D6878717EBB1B80413309BDF4150866A9F73BE16A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Release/dxcompiler.dll
- Size 24.6MB
- SHA256 46ffdac0d5356f2a4ac8f77f45f66a10b890853f3b010cd435637f02969d5ebc
- MD5 f189ae0ef6de49c4c0d822c0d57f3ba8
- SHA1 9ca2128608adcf11eac4d6fa50609673e2810b46
- SHA512 9d5b0d73aaa4388f70524b1aae2d80da657e64ee44c3d9fe65c7769021c4df745e71a8cf10f8014ba5970744dca3ef6729013d55fa8814326269a72730d02302
- SSDEEP 196608:jHldB43nVOIfoRAfTYTgsBd9FY2cGkDxxSXgemDEEErGS5:Bf4F9Amraj9iGmDEEE
- TLSH
  T1CB472A122646D49DF059C878C3678626CA6C34E73FA778EBC0B461252B7BDBC1B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Release/dxil.dll
- Size 1.4MB
- SHA256 473f5e853120a5b6ca583ac51f453664abae15c0db1d307f29c8bf7a7b89f96c
- MD5 360c2ec3a4114840498e4b0f45820395
- SHA1 d5d4a71933fa25ec338cdf18d7a03281fe814d7b
- SHA512 257d1443341792587b0259d658a706dd8797a83644e451f2bd6d5b292d8259ea11c5d1b176541747a5470a2562615edd44b147e6ad752b4714458db28b07f9c3
- SSDEEP 24576:4Y+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kab:FiTMYxy0Sy66Zh7Sh/cyvS5Z
- TLSH
  T185657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Release/krnlss.exe
- Size 2.5MB
- SHA256 c616b8cee7cc2e75aa475252e25255c1130891337d1021f6a24cda5f1d2c53a0
- MD5 aa735e749b084a79acb740283b0a4600
- SHA1 f4dc1647bba231f080bd72e3b39ab4e7baaff5dd
- SHA512 c7a6d2f3820cc74af610de98b4b366d6e73f89ef2e9e3a78749acceeef0d6359a6ddf26dd75bddab0674f3bd33a3357e007beeb08d2edae788a262448b7d05e2
- SSDEEP 49152:QtsgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4RIUDR:Q6gVUuHjkDGjYQDGuRxzew
- TLSH
  T1EEC5011C33F58A0DE1BF0BF8A4B189564772FC129D56D76E19A5B8EE04B2F44AE10723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution ratonrat persistence stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
- Looks for VirtualBox Guest Additions in registry
  defense_evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Looks for VMWare Tools registry key
  defense_evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral17
- Target
  Release/libEGL.dll
- Size 480KB
- SHA256 ffe47f5c544b1c80adedd5ab3966e4a6169981745e8aa0852a19fab8ef18d946
- MD5 788ff13cd4d49d1bf114ccd907b7b713
- SHA1 62ad899bb89d3b8f482ed24864d33b32b1a6eb1f
- SHA512 5608eb5b73fb768dba05cab949c075d77849025d1bec6fe8ee97887e4cecce519731a00713b6d78fa430ce2face7a29276500606d9e252a20ef21fa91b4894de
- SSDEEP 6144:HxzBKPeAhuFkfWBJE1ZYfCI3OF7QicME03HV+N/riDv:HZBRueAYfOF7Qicw3YNeDv
- TLSH
  T101A46D16B7E885A9E42AD134CA534247E672B8420B71F6DF03D092792F7BBE45B7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Release/libGLESv2.dll
- Size 7.5MB
- SHA256 dfbf8786be721310d74931e64b95d2b567b525144848dcf9c0e4da58586cb31a
- MD5 f50c1e9e932ae72f5a244a6c341d4e56
- SHA1 fc73c9baf53f3fe9e31b61f712f2005e035ad521
- SHA512 b7ca11af85d0c603c44396b68ebb2fc361db25da93803c45e313cead5d71f17abed3f3c99417a203ac05ece121160dc0086fbf5a35667365568c3cc652abd338
- SSDEEP 98304:aunXUNt6H8MQfaYYGUCYXy+lyWruXpoDs:rnXUE8MQ/W6pMs
- TLSH
  T1E5866B03F69980D9D01DE2B8C75BA623F635B8850724B2CF279457162F67FD0AB3A718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Release/libcef.dll
- Size 224.0MB
- SHA256 3bb9040ef7f549b5c2af73dae9b6cb4015db8883159606db8815673c095122b0
- MD5 55c178d0fcf993b17080d93c287bf4c8
- SHA1 52d58fef41b4dd514cc4b75969d32b6dd2fedd91
- SHA512 2941be8af6c4fc0a025826153bb30b2473f6015f69bc054030942cf4d8270b2054d7e70620221c1ed38c75391d183566562c291eecc42511bcd7b79ce2529e6a
- SSDEEP 1572864:z23nsU1Axc64I7qiQWVM2+vhLdK/pXDl3VcE6k1v7ge5JYDixcdHPv0Bzwc//Iuv:yCa8bbq5t
- TLSH
  T182B87B03F29A40E9E05CD2B59B578637EAB178850325B2DF17540B922F77EE86B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Release/vk_swiftshader.dll
- Size 5.2MB
- SHA256 c2e65d85fa882f239213e9b469eca41751267f876d8f722f20d349ba9d28eb4e
- MD5 620310c8f460e98ef8a1c8f179742492
- SHA1 936ac2a9ef07dd5be10d630a37c66452c8195c7f
- SHA512 490178993f737b1c4ee86a90d2081a3628da54b67d0561b0c46d566ceb681651767932945551a08a9a654472162c9c4ef43a0831b57a875fb6eb005d3d158912
- SSDEEP 49152:7ECSlXfQcfKBzefFoH1Jf+L/ZkiEuA5JCbEHccY9RzJ/x+pWiGOdOHvJxYhuY4c1:o7XfVdH+Sgl4c8TyyA/zLB
- TLSH
  T191462703F2958099F05DD579875FA623F222B8801B76B6DF12A41F192E7BFE06B39701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Release/vulkan-1.dll
- Size 867KB
- SHA256 4071baacf171008950db302f52adff1c36a9346a95e8d25aba71ee073c091b1f
- MD5 e0907a3e5aa6ce1b02af739c795fdb4b
- SHA1 d4aae0d9aa95fa0dc1b5956df5241c9dd13b8772
- SHA512 58f678085c6e098e00ac71bf59e5666590e08388d8cde0397490053d134d3a2373a91b4f66553eb0d139ae759f88faf7e86e42108a38038211280dbd0f36bcb2
- SSDEEP 24576:i+JuYKjKOfdrb6BUeG4vM7t6Z5WSDYsHS6g3P0zAk7pL:LJuNjFdreBUeHkt6Z5WSDYsHS6g3P0zX
- TLSH
  T1C3158C13A7948669D47AD034C9C28603C9F174A21326B9CF42A85718BF6BFF47B3DB25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22