Analysis

  • max time kernel
    898s
  • max time network
    427s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/10/2026, 20:28

General

  • Target
    Raton Proff v4.2 crack/Builder/clientForNull.exe
  • Size 1.3MB
  • Sample261007-y82desfx2p
  • SHA256 adf4a41c8900d5a0316555023ce8acafaebc9d761a4ebe0b5385b4f936db8e05
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Extracted

Family
  • ratonrat

Version
  • Professional

Mutex
  • silly1

Attributes
  • assist

    silly11

  • box

    silly8

  • box_icon

    silly10

  • box_msg

    silly9

  • box_title

    silly17

  • defender

    silly23

  • delay

    silly5

  • hide_file

    silly7

  • open_website

    silly13

  • password

    silly20

  • process_critical

    silly6

  • raw

    silly21

  • reconnect

    silly22

  • startup

    silly4

  • tag

    silly16

  • uac

    silly11

  • vm

    silly15

  • website

    silly14

Signatures

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

  • Detects RatonRAT payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForNull.exe
    "C:\Users\Admin\AppData\Local\Temp\Raton Proff v4.2 crack\Builder\clientForNull.exe"
    1⤵
      PID:5092

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          stuff.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Costura\950BDAD80D65EA7FC5FD07F1244F1737\stuff.dll
          • Size 11KB
          • SHA256 db4f07306bbddcc664051ee53db6f37f343f01bab6da7276cf1b600adcdfdf72
          • MD5 SHA1 SHA512 SSDEEP TLSH

          memory/5092-0-0x000001D4A51C0000-0x000001D4A5310000-memory.dmp

          memory/5092-1-0x000001D4A5750000-0x000001D4A5760000-memory.dmp

          memory/5092-45-0x000001D4C0A80000-0x000001D4C0A8A000-memory.dmp