ratonrat | ee48291d502ceb31ffb1b6a2133df7bde1b1900089c2e669166835101917764d

Sharing

Copy URL Twitter E-mail

General

Target
raton.zip
Size 88.1MB
Sample261007-y82desfx2p
SHA256 ee48291d502ceb31ffb1b6a2133df7bde1b1900089c2e669166835101917764d
MD5 87e0adadc1b77ad52cb05b7629917043
SHA1 62673f3878fd53123d60a57c3782e5021f639038
SHA512 e4205c997b03cbbbb29bc984b1ad57cf8ab364bc49fd9bafb3d4fbd2c36067bfad5d1aa09645ced7ff842d5b0764896beed5c15fe55d268d33a27214d3df0a9b
SSDEEP 1572864:ab2/Ep2kuV1GyurXgUBPaSjNtvAVsoQf+N2PyUDzHnKSUZl:W2/Eny1GBrXgaa6tSsod2PtHHnKSUl
TLSH
T1791833A88B4E1E26F1015BB7409252F48EFFD48F72F2F7AE6D4493D15887AD934A4903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

Professional

Mutex

silly1

Attributes

assist
silly11
box
silly8
box_icon
silly10
box_msg
silly9
box_title
silly17
defender
silly23
delay
silly5
hide_file
silly7
open_website
silly13
password
silly20
process_critical
silly6
raw
silly21
reconnect
silly22
startup
silly4
tag
silly16
uac
silly11
vm
silly15
website
silly14

Targets

- Target
  Raton Proff v4.2 crack/Builder/Client.exe
- Size 594KB
- SHA256 6293967023e1c48205cfb8cdadcb89a30c249ed056b7fa931bfd3e1d65f18afb
- MD5 0ba9a62c2a7bb33ffd6024130d050b9d
- SHA1 b409d7ad8df6ceafb31a7498d98a3e318baf85da
- SHA512 5d697cdab4a322b40c11621d444b9747c2eae9677a31b636631cc553531ef40c5855cdd1ef2cabbec02217db2d41f29f436c7022bf8a8ec681326e40eebc5159
- SSDEEP 12288:yx3374rIkzE7tnXknXQaBFJi4RkTAJ0MK86WoLb66OPfD9piI+3v:YL4kkA7lXkXDDuAOFhWSApij
- TLSH
  T159D41208B3FC3716E77ECB3E5CF190481EB276535920E24C4D8394AA16B5781AA74BE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral1 behavioral2
- Target
  Raton Proff v4.2 crack/Builder/clientForCrypters.exe
- Size 2.4MB
- SHA256 cc71485df618bf576ab63ce7872a1b244d6c0b16a8968dcc072015da402bf76c
- MD5 984638de0848645058ed57f374e65992
- SHA1 87a28425aafb84cd9f423c40715fccf61c317e5c
- SHA512 5c0b8f9d3d08ed88658cee68d370d8a74b8132e303663634df191f3256039714e9a4a358668b32f401b009c8f3a239015e7107c3d9432619aea1d7813c2b31df
- SSDEEP 49152:gWgVUlsHjkmiGWU5+5WNJ6clRcBxMTanw4m/nw:3gVUuHjkDGjYQNAuR5TWwZ
- TLSH
  T17AC5015873F9C629F1BF4BB4E4B1492A5771FC479C92E75C08A678AD04F2F44AA10B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral3 behavioral4
- Target
  Raton Proff v4.2 crack/Builder/clientForNull.exe
- Size 1.3MB
- SHA256 adf4a41c8900d5a0316555023ce8acafaebc9d761a4ebe0b5385b4f936db8e05
- MD5 a6885837e3ecc30953f6ef1c7b0bcadc
- SHA1 62daffc6dc42372d3f39f05d732580d700156676
- SHA512 461281f9d7d86bb76f2b1320dc9f4555697240ff0e7cf7cc116b6943a172228d9d106da7cd11e01afd66faf4a7b3132a455f652570f2cd3262dabdc4ab84a7f6
- SSDEEP 24576:zIDf2UnDE27SP1v9CTP0lRpkxYcxMNtyFoBkkA6s4nu7X1:zIip6clRcBxMCanw4nu7
- TLSH
  T13855D05C33F98A18F2AF4BF4E8B1441A17B1FD579C52E75D18E664DD04B2F44AA20B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral5 behavioral6
- Target
  Raton Proff v4.2 crack/DONOTDELETE/Commands.dll
- Size 3.8MB
- SHA256 127890e44c1393728dce34c3921f78cfb4d1bd4b25c3866efeb50e00ac403ccc
- MD5 558ecfb4428dbe6a6f5dfe85fd27942d
- SHA1 1d04a1deb08c61060fb44c87823b4ee227fda1a6
- SHA512 b564406254d71ee1ea6ceab1a10234bd1b481a54303c0d68d272d8c615568342c0234b2d5edc1c3dfd88b3b11d4a5fb9cbfd6967e76deff7f156636b1ba0a8d8
- SSDEEP 98304:Cdd6TFO4y6vg9dTdyizGrJM+Rd5qlBPi/RXRm6VSrf9Raa8Xc/hiVx7XxvHWP7o8:CsgVzHASj5x
- TLSH
  T14A069D91BBE4CE27E09F1372E4B206010BB1ED85A763E78B198439B95CB37446D153EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Raton Proff v4.2 crack/DiscordRPC.dll
- Size 90KB
- SHA256 44d71f4c058cf8d0e531a1a1d5e9d892bae0784479509be3d921a7c59b85270d
- MD5 9f747cc51687d853f92f70a537ff6ca6
- SHA1 5efe5fbbe266066572d15a138bbff2bc0c578a46
- SHA512 87855c0a47336c9c48c1e5726fa80c631d612c0b024e259376cde324dbb91c15131d7cff60c79f97d7987d234ed5b22ec6f2c4d20d6586b4143c9853cf87511b
- SSDEEP 1536:KOBvajHhXD0UroUVBxECc7kGFkgfLM9wUwRDzJO+mHxULSiI:mjBXfroGxECzGbokR4+meI
- TLSH
  T102933A6597FC4679E2BE2B34E4B052410BFAB989B931D79F4A0810CE1E13BC25D617B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Raton Proff v4.2 crack/EntityFramework.SqlServer.dll
- Size 577KB
- SHA256 a960dd4d2f0f37b3c09ffb9567c32426b8791310d7eb935c04c819c3d46bd49e
- MD5 af1646b1c2227ab206d855bd068535cf
- SHA1 3cd982ad2fb00a50151d7f416e4b05f79528496e
- SHA512 04eb6b5ec3a1655ae2fc661f6f9053f7743a2c624c4e8b0e1e6660fcb135a847adda27919ae8f38987e370e0114bd5ce45e01f1c894019a864a22cae3d24af0a
- SSDEEP 6144:EcK9UcUZV25QiE0U0CxzB6zHK1HHYkIfPQG2puGeqVmjaVmnS4bfu65+:fcuV200veIJu65
- TLSH
  T187C4F715B3E45E24C3BB4230583A701CEAB582F3627D0694F95EA3DF6FBA91115A3723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Raton Proff v4.2 crack/EntityFramework.dll
- Size 4.8MB
- SHA256 ff42bca704605e187abb45523868b15128d6af1c28ad40a4579d507d34a953b2
- MD5 ffdcf232d0bb2fff78721fb347641a76
- SHA1 54c76a2fa61e6df1ae4c9df65435a38482c2cb71
- SHA512 89df103556cfbd955283bee551576134f9a7b0d121e12cf6df4e9f4028075b2c4ff9d22886cfd21b10d0a0d6e640db784b74d42ebac4a45ccb9ce9c725a1fdf1
- SSDEEP 49152:9PrnRLX8ziolcD5jX24Y/g1YmNBayW5Ci72yEBzw9vb5:tnt8zi8o5jX24Y/fmLaZv7xt
- TLSH
  T1EA362942F3E81F2AE1FF067AA435604A5AF5FC6A1352D65E381CB1AD1F227005A63737
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Raton Proff v4.2 crack/FastColoredTextBox.dll
- Size 323KB
- SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
- MD5 8610f4d3cdc6cc50022feddced9fdaeb
- SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
- SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
- SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
- TLSH
  T16564391012F84659F27F47BDD4B9C01CC3FAB566A99FEB0E89A560DA2EF37409905233
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  Raton Proff v4.2 crack/GLWpfControl.dll
- Size 24KB
- SHA256 f279ead5aa0e5ef8faa71d57865ac125b76a1023f65e694a1fb961c87d7c3abb
- MD5 d18b26f23c2fb21510ece68668908d01
- SHA1 aeb2a93489264c05a6606f5b114fafb4b2d68df7
- SHA512 e6495e156ff39d23baab8971c90919f5b2fc0eb81d5987f78f25816ea9d7ba2b1d07fa03e06dce33c4d230a3855dd4735d3a866ce169a5c92ae8365e602e5af1
- SSDEEP 384:fYYtoMUkOlplX3n3tjIk0iOTmqawO8reZIAtjumabXXXoAp4App:gIn0lX33tjwioMwGsBbXXXoApnpp
- TLSH
  T1FDB23B1AE77CC72BDAAD167AEC771D1403B1AB446116E7CA0D8460EF7AD37100606BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Raton Proff v4.2 crack/GMap.NET.Core.dll
- Size 304KB
- SHA256 b260bd61d577d7cf6daf5e954a8b894999441833c33ef270c9e73d7dd8580dc6
- MD5 112a37e4e190b6af687fc71a8518562f
- SHA1 3be3c34b4245cb8c27b348acf0273592b84a8822
- SHA512 a6ed4ad3ddfab121176818273b9f9f2ed3bd0c6d37a6f5173ae1256ba6dee47e2c6f40d763885934b2736380d74a0bfb0ded7cc7d24e0d847d378c485ef48ab4
- SSDEEP 6144:FFj7zE9i6vGyNr9Fb8d+Vb8uJgbqefHLBBlwePz:7j7zki6vGyJPb9VP0H
- TLSH
  T1E9644B1827E8962BEFFF4B7AD0701D2E5274E01662BADF6D4694A1FB2D137827400673
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Raton Proff v4.2 crack/GMap.NET.WindowsPresentation.dll
- Size 55KB
- SHA256 194fc0defdb71052d9acd21c9bd004f8b98f463e95fad5f8106d9c9e7c674e19
- MD5 0ed344a5005d6e31e448f1a23d26e307
- SHA1 3bc89732fc9f788ec1cdd9454858d3d3a8bd458d
- SHA512 eef285b60ef066e49789237451bc8dbdcf6e892935741e6c9978ebbc4b355c93ef69f417ca30798096197a1ce282d1ac27d185281ea73ad0183777f695c49dff
- SSDEEP 1536:U191sCtO1MZvboXcDYBVIV5aBIzEX5TZ:w91Jo1MZcccPcasMZ
- TLSH
  T1C3433A91A3684A2FD9BF0BFAD4A402111B71C657B622E78D1FF490BD89DB38106163DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Raton Proff v4.2 crack/HarfBuzzSharp.dll
- Size 211KB
- SHA256 9686613b1866cb67c29e13885f6f48ea996466717c6544eb4e8cfd288d95f0fc
- MD5 d63a420952abb5177b9be005bbc067dd
- SHA1 c79de5b30992bd3f7aa81ae9bd55ad556a70dd9d
- SHA512 290d7e9c8216e7ada4dd055259b04fce532ff716e8502f20897ab42a5b5596edf591e0d587563b2905c3eead5fe16534693bad821b68945f0100318fc73284b5
- SSDEEP 3072:a/p1HOiPz6QDZD0XCqxrsHzDiEUAcUSbjI:a/pHPeODuCesHz2
- TLSH
  T19324C64887F48DDAF1EF4739A4B625810A71F9C36113FB2A299491BA3382F5CD1E9353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Raton Proff v4.2 crack/LiveChartsCore.SkiaSharpView.WPF.dll
- Size 349KB
- SHA256 a31c134d4823dfb201d012d3d30c2518412f9eb38b8da669831662cbe3b7cbad
- MD5 dd24716bf32ced81594025c98bce3702
- SHA1 fc6f0402c8305da739d9b2bdeb7c12de89860749
- SHA512 ffeb29856d44658fd65d82db52f4c733d252c10b77cf62e14e42e143312b59ddfb42653eefc1a95d5493902230c8f104084b8e5a038b100045cdaae4937ff54f
- SSDEEP 6144:uyJ+5GkVx2VqdqQuq+iKYJR8mb/0QF8NLQ0000000j600s0ByZ1wIWG063TY07L:u1+iKYc1r3Tv7L
- TLSH
  T1AA7496C0931C9936C3FF4A73211966242B31CC0798E5D76925E2E1F62DCBB226FD51EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Raton Proff v4.2 crack/LiveChartsCore.SkiaSharpView.dll
- Size 133KB
- SHA256 c63c99f8cc07c79cf59d6c836d2ef4bf0af9ce051b386f0a2059bd91c3af3702
- MD5 b4509c87e576adcba2532e5cb56e9a46
- SHA1 b647d556ae0a32c81a7ae69951f859d32daca1bc
- SHA512 ef87b86bd7d1c2eb6ed2abf425e73d453681d54605826d8664409538d87731e7dc9572c599db9004baadb68f6858c64e6b66839db4668e22a9e104d9e89816b0
- SSDEEP 1536:Zr+gD9f6L3U/08p3uiXfXbae8bvi8czRaulmU8S72p+Y/WA+NBZNHE0hOTc8vRFm:J+DCuiXfXO1b6Nl98+n65rvjdt8/QG
- TLSH
  T1E2D34A7693AC872BC6BF1639F0A4020597B1DA07D4E1FF896B4CE49E9C53388B914772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Raton Proff v4.2 crack/LiveChartsCore.dll
- Size 758KB
- SHA256 1c1863cba4796cc3444e9ad2ca5382dc75415d1abb4dc166201b05b39f8d6cb4
- MD5 1fffc81d50dde12158aff48b662e4812
- SHA1 8dd12223ca5f2fed29047f6d44259138164e7652
- SHA512 ca7818b899bada92c44e347c41f82a72e1c1195fa06eb48bc81223e6ffca5198a7498f534a3d2fb468b93495dc93f9850e8516844a9e53d1765801d3b4309017
- SSDEEP 12288:b8MIUYKrbP8ABozKMIvIamS7h5NfUjXd7Sz:bKHfABozKPlH
- TLSH
  T1BBF45B69D39CC7BAEC4D4F3AA020342A67F491277CE3D3CEDA0DE5F529867921814D62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Raton Proff v4.2 crack/Microsoft.Bcl.AsyncInterfaces.dll
- Size 26KB
- SHA256 80678203bd0203a6594f4e330b22543c0de5059382bb1c9334b7868b8f31b1bc
- MD5 ff34978b62d5e0be84a895d9c30f99ae
- SHA1 74dc07a8cccee0ca3bf5cf64320230ca1a37ad85
- SHA512 7f207f2e3f9f371b465bca5402db0e5cec3cb842a1f943d3e3dcedc8e5d134f58c7c4df99303c24501c103494b4f16160f86db80893779ce41b287a23574ee28
- SSDEEP 384:cOJWqnwCBbNAP0VES2j0cX6dAl+NWpVzrdcoquWeP/WxR5kHRN7dDFcYR9zPrf8O:culwCBhdVv2wK5fdcUtFFn9zT8pY
- TLSH
  T14FC27C1A935C1317CEAF2EB4E570D9422935E78A2C22EB3E1588F2950D97345EB31738
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Detects RatonRAT payload

Family: RatonRAT

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32