Extracted

• • Target
    Rebooted-Spoofer.exe
  • Size 2.4MB
  • SHA256 3342d3eacfa364f281b65e280ce511f3ad467d439b08332444441efc05a3db50
  • MD5 3f8badfb600bbc4b340367cdec0465a1
  • SHA1 b983b0388133d6a2da634046590d9f680e2c8c66
  • SHA512 e080a3135f4de2f68a34641de7b8b262fef73f8ac99f5c601c83a66864e535003289fab05bd953eb4b6e0bdafb369801a3749bf7c2ad1191237efa0e02ef5a31
  • SSDEEP 49152:UtgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4OKP:AgVUuHjkDGjYQDGuRxzew
  • TLSH
    T1E9C5016833F9860CF1BF0BF4A4B149664B72FD079CA6D76C18A579DD04B6F44AA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistenceransomwarespywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Renames multiple (142) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Boot or Logon Autostart Execution: Print Processors

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1