Analysis

  • max time kernel
    899s
  • max time network
    472s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/10/2026, 20:28

General

  • Target
    Raton Proff v4.2 crack/Builder/clientForCrypters.exe
  • Size 2.4MB
  • Sample261007-y82desfx2p
  • SHA256 cc71485df618bf576ab63ce7872a1b244d6c0b16a8968dcc072015da402bf76c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • ratonrat

Version
  • Professional

Mutex
  • silly1

Attributes
  • assist

    silly11

  • box

    silly8

  • box_icon

    silly10

  • box_msg

    silly9

  • box_title

    silly17

  • defender

    silly23

  • delay

    silly5

  • hide_file

    silly7

  • open_website

    silly13

  • password

    silly20

  • process_critical

    silly6

  • raw

    silly21

  • reconnect

    silly22

  • startup

    silly4

  • tag

    silly16

  • uac

    silly11

  • vm

    silly15

  • website

    silly14

Signatures

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

  • Detects RatonRAT payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForCrypters.exe
    "C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForCrypters.exe"
    1⤵
      PID:452

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          stuff.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
          • Size 12KB
          • SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/452-0-0x000001C673D80000-0x000001C673FF6000-memory.dmp

          memory/452-1-0x000001C6743A0000-0x000001C6743B0000-memory.dmp

          memory/452-45-0x000001C6766D0000-0x000001C6766DA000-memory.dmp