General

  • Target
    kwdld1.zip
  • Size 162.0MB
  • Sample260930-bkllqsz1cw
  • SHA256 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • ratonrat

Version
  • Professional

C2
  • 192.166.82.131:1488

Mutex
  • QuXBDOHucYTZbvkiebLPAay

Attributes
  • assist

    true

  • box

    false

  • box_icon

    Error

  • box_msg

    I'm the message box description

  • box_title

    Hello World

  • defender

    true

  • delay

    0

  • hide_file

    true

  • open_website

    false

  • password

    t.me/junk_code

  • process_critical

    true

  • raw

    silly21

  • reconnect

    3

  • startup

    true

  • tag

    Infected

  • uac

    true

  • vm

    true

  • website

    https://t.me/example

Signatures

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

  • Detects RatonRAT payload 1 IoCs
  • Unsigned PE 31 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • kwdld1.zip
    .zip 162.0MB
  • Release/Bin/Decompiler.exe
    .exe 9.4MB
  • Release/Bin/current_version.txt
    5B
  • Release/Bin/erto3e4rortoergn.exe
    .exe 6.4MB
  • Release/Bin/tabs/0_name.txt
    11B
  • Release/Bunifu_UI_v1.5.3.dll
    .dll 236KB
  • Release/CefSharp.BrowserSubprocess.Core.dll
    .dll 1.3MB
  • Release/CefSharp.BrowserSubprocess.Core.pdb
    9.9MB
  • Release/CefSharp.BrowserSubprocess.exe
    .exe 6KB
  • Release/CefSharp.BrowserSubprocess.pdb
    19KB
  • Release/CefSharp.Core.Runtime.dll
    .dll 1.9MB
  • Release/CefSharp.Core.Runtime.pdb
    11.1MB
  • Release/CefSharp.Core.Runtime.xml
    .js .xml 580KB
  • Release/CefSharp.Core.dll
    .dll 1007KB
  • Release/CefSharp.Core.pdb
    2.6MB
  • Release/CefSharp.Core.xml
    .js .xml 1.6MB
  • Release/CefSharp.WinForms.dll
    .dll 53KB
  • Release/CefSharp.WinForms.pdb
    153KB
  • Release/CefSharp.WinForms.xml
    .xml 103KB
  • Release/CefSharp.dll
    .dll 275KB
  • Release/CefSharp.pdb
    1.0MB
  • Release/CefSharp.xml
    .xml 919KB
  • Release/ScintillaNET.dll
    .dll 1.3MB
  • Release/VelocityAPI.dll
    .dll 16KB
  • Release/chrome_100_percent.pak
    718KB
  • Release/chrome_200_percent.pak
    1.2MB
  • Release/chrome_elf.dll
    .dll 1.6MB
  • Release/d3dcompiler_47.dll
    .dll 4.5MB
  • Release/dxcompiler.dll
    .dll 24.6MB
  • Release/dxil.dll
    .dll 1.4MB
  • Release/icudtl.dat
    10.0MB
  • Release/krnlss.exe
    .exe 2.5MB
  • aforge.dll
    .dll 17KB
  • aforge.video.directshow.dll
    .dll 60KB
  • aforge.video.dll
    .dll 20KB
  • costura.dll
    .dll 5KB
  • microsoft.win32.registry.dll
    .dll 22KB
  • naudio.asio.dll
    .dll 33KB
  • naudio.core.dll
    .dll 183KB
  • naudio.dll
    .dll 7KB
  • naudio.midi.dll
    .dll 45KB
  • naudio.wasapi.dll
    .dll 176KB
  • naudio.winforms.dll
    .dll 33KB
  • naudio.winmm.dll
    .dll 56KB
  • newtonsoft.json.dll
    .dll 704KB
  • stuff.dll
    .dll 12KB
  • system.buffers.dll
    .dll 20KB
  • system.memory.dll
    .dll 138KB
  • system.numerics.vectors.dll
    .dll 113KB
  • system.resources.extensions.dll
    .dll 78KB
  • system.runtime.compilerservices.unsafe.dll
    .dll 16KB
  • system.security.accesscontrol.dll
    .dll 30KB
  • system.security.principal.windows.dll
    .dll 14KB
  • Release/krnlss.exe.config
    187B
  • Release/krnlss.pdb
    227KB
  • Release/libEGL.dll
    .dll 480KB
  • Release/libGLESv2.dll
    .dll 7.5MB
  • Release/libcef.dll
    .dll 224.0MB
  • Release/locales/af.pak
    582KB
  • Release/locales/am.pak
    935KB
  • Release/locales/ar.pak
    1.0MB
  • Release/locales/bg.pak
    1.0MB
  • Release/locales/bn.pak
    1.3MB
  • Release/locales/ca.pak
    660KB
  • Release/locales/cs.pak
    671KB
  • Release/locales/da.pak
    612KB
  • Release/locales/de.pak
    660KB
  • Release/locales/el.pak
    1.1MB
  • Release/locales/en-GB.pak
    530KB
  • Release/locales/en-US.pak
    535KB
  • Release/locales/es-419.pak
    645KB
  • Release/locales/es.pak
    642KB
  • Release/locales/et.pak
    588KB
  • Release/locales/fa.pak
    954KB
  • Release/locales/fi.pak
    597KB
  • Release/locales/fil.pak
    675KB
  • Release/locales/fr.pak
    696KB
  • Release/locales/gu.pak
    1.3MB
  • Release/locales/he.pak
    842KB
  • Release/locales/hi.pak
    1.4MB
  • Release/locales/hr.pak
    650KB
  • Release/locales/hu.pak
    698KB
  • Release/locales/id.pak
    579KB
  • Release/locales/it.pak
    640KB
  • Release/locales/ja.pak
    774KB
  • Release/locales/kn.pak
    1.5MB
  • Release/locales/ko.pak
    654KB
  • Release/locales/lt.pak
    702KB
  • Release/locales/lv.pak
    702KB
  • Release/locales/ml.pak
    1.6MB
  • Release/locales/mr.pak
    1.3MB
  • Release/locales/ms.pak
    607KB
  • Release/locales/nb.pak
    586KB
  • Release/locales/nl.pak
    608KB
  • Release/locales/pl.pak
    675KB
  • Release/locales/pt-BR.pak
    633KB
  • Release/locales/pt-PT.pak
    638KB
  • Release/locales/ro.pak
    661KB
  • Release/locales/ru.pak
    1.1MB
  • Release/locales/sk.pak
    682KB
  • Release/locales/sl.pak
    655KB
  • Release/locales/sr.pak
    1003KB
  • Release/locales/sv.pak
    591KB
  • Release/locales/sw.pak
    623KB
  • Release/locales/ta.pak
    1.6MB
  • Release/locales/te.pak
    1.4MB
  • Release/locales/th.pak
    1.2MB
  • Release/locales/tr.pak
    634KB
  • Release/locales/uk.pak
    1.1MB
  • Release/locales/ur.pak
    946KB
  • Release/locales/vi.pak
    752KB
  • Release/locales/zh-CN.pak
    541KB
  • Release/locales/zh-TW.pak
    538KB
  • Release/resources.pak
    10.9MB
  • Release/v8_context_snapshot.bin
    695KB
  • Release/vk_swiftshader.dll
    .dll 5.2MB
  • Release/vk_swiftshader_icd.json
    106B
  • Release/vulkan-1.dll
    .dll 867KB
  • Release/workspace/CMD-X.lua
    809B

kwdld1.zip

  • SHA256 3d17040f30110c2d85c9f76575f740e05aafe5288eb28baba21b38b2b1d84a7e
  • MD5 SHA1 SHA512 SSDEEP TLSH