Extracted

• • Target
    https://www.mirrored.to/files/52993C91/

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitratonratpersistenceransomwarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Renames multiple (503) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Possible privilege escalation attempt

    exploit

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1