Extracted

• • Target
    ratonClient.exe
  • Size 1.2MB
  • SHA256 2e60945731490a1f55d7ba0fdaa43f8f24843961008730758931aa997a2447f1
  • MD5 e1068c734c3856c1f5a61b1162bef595
  • SHA1 c150fd682f4aaeff9a57f3f7d5fc025b5d29d05b
  • SHA512 c2b1a7b1ebc1ee86fb8e4b900ff6a914f8233c90d19ca7cd257139190fcd14ba6ea0beb451480956074885dee41c912a51f8379ec36fd6fb8eb92c5a65ba0f94
  • SSDEEP 24576:oz9UXSrtv94TP0lRRkxYcxMNnyFoBOkA6s4GIquO:ydsclR0BxMsaRw4cuO
  • TLSH
    T19355DF5C33F98A18F2AF0BF4E8B1451A0771FD579922D76D19E678DA04B2F44EA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealerprivilege_escalationexploit

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Possible privilege escalation attempt

    exploit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2behavioral3