ratonrat | ratonClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ratonClient.exe
Size 92KB
Sample261025-qefkvsfz2t
SHA256 2c1f45e5fc2f80ec90796f92bcf4c89f30bd85b4eb20384bcd48ffae5d05fa48
MD5 9a451e237b66cdac99709083bbe32768
SHA1 72d9de699a4623de78cc65703410f1e26fc0e93f
SHA512 2e0cab45179845a53ad2283f60d88f23765e0570e752654e2d1dbf505fc9a8fa9f76170d4df2ce6b3c43af6b53ebae80235537ca34afae51e8f0e2f7c5689af9
SSDEEP 1536:8VRBk4yTYKWPdq/fTsqa4tsi53xlEZb4SbWKdsCdlU0/BHwH:89qsKWPGfAX4tnREZb4SbWKxdlZHwH
TLSH
T1C5934B4073EC6A36E2FF8BBD19B434504B72B9175E21D24DAC86209C1A71B81DE64F7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

costura packer stealer ratonrat

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

somedude-56621.portmap.host:56621

Mutex

Z5YFiUqRMaaukfPcP7E0qOR

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
true
open_website
false
process_critical
true
raw
silly21
reconnect
3
startup
true
tag
Infected
uac
false
vm
false
website
https://t.me/example

Signatures

Family: RatonRAT
RatonRAT is an information stealer written in C#.
stealer ratonrat

Detects RatonRAT payload 1 IoCs

resource	yara_rule
sample	family_ratonrat

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
sample	costura

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
ratonClient.exe
unpack001/costura.dll
unpack001/messagepacklib.dll

File Explorer

ratonClient.exe

.exe 92KB
costura.dll

.dll 5KB
costura.pdb

7KB
messagepacklib.dll

.dll 10KB
system.buffers.dll

.dll 20KB

ratonClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2c1f45e5fc2f80ec90796f92bcf4c89f30bd85b4eb20384bcd48ffae5d05fa48
MD5 9a451e237b66cdac99709083bbe32768
SHA1 72d9de699a4623de78cc65703410f1e26fc0e93f
SHA512 2e0cab45179845a53ad2283f60d88f23765e0570e752654e2d1dbf505fc9a8fa9f76170d4df2ce6b3c43af6b53ebae80235537ca34afae51e8f0e2f7c5689af9
SSDEEP 1536:8VRBk4yTYKWPdq/fTsqa4tsi53xlEZb4SbWKdsCdlU0/BHwH:89qsKWPGfAX4tnREZb4SbWKxdlZHwH
TLSH
T1C5934B4073EC6A36E2FF8BBD19B434504B72B9175E21D24DAC86209C1A71B81DE64F7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
MD5 109bd38d2107f41573c48544992ead99
SHA1 028e9832f421f11f9497c610f1734e0f3d868037
SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
TLSH
T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\CI_WS\Ws\274459\Source\Costura_Fody\src\Costura\obj\Release\netstandard2.0\Costura.pdb

messagepacklib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 30fc8808c22b5073ca2c691784369a36dbdb855aa1b9e50c909225c5562b0e95
MD5 e14bf49aa22e8b4b13cee211f9c246dd
SHA1 67a52a50875b6072355d725cd38dd69a592f6480
SHA512 5cedb8c0de141be1db2afb60e42621d1ac87b493bceea7fe64eeb774ebfd598155301a498a4b2ec40af89a79192f742b665055c5496c7a20469d0718378061c2
SSDEEP 192:ittESK1s9acvVfbTa+fwcOADyxZK0ffCZyO+:0EC3jwcOdxZKSCZyJ
TLSH
T1B422F91CF380856FCEAA077C7CB216452776F2086553DFAA0D88B4FB5D537A40A22659
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16234

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

system.buffers.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
MD5 ecdfe8ede869d2ccc6bf99981ea96400
SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
TLSH
T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects RatonRAT payload
Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

Digest

d4:65:dc:35:86:93:2f:fb:0d:d0:c1:ac:2f:31:92:bd:28:75:14:21:57:3f:3b:7d:55:33:05:32:59:3d:d4:62

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Feb 19, 2020

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

Major OS version

Entry point

17218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netfx\System.Buffers.pdb

ratonClient.exe

mscoree

dotnet

costura.dll

mscoree

dotnet

costura.pdb

messagepacklib.dll

mscoree

dotnet

system.buffers.dll

mscoree

dotnet