Extracted

• • Target
    Datenschutz_und_Sicherheit_28.10.2026.vbs
  • Size 15.8MB
  • SHA256 88d29233f8bdff4add18e12e2929dffb0b9a4a2ce7ae10e8f419a1f1a5f6b014
  • MD5 e171935a51b2ff8bd03e1c52f8cb2d7c
  • SHA1 2e87fb243b0f977d892bb39b58734087c16d0b7a
  • SHA512 b6e2a71d333b3aff56cd89c9f3cc08773625fcb0f1c3ce3e2c3dc533ebbc7dbd91faa097a4e74f40898740778edcbe67d9fa113b68952fb2116e412e5b47b456
  • SSDEEP 49152:9LbNQXNmHFOn8zENRwOgkXCOA/bSq/BsxP:y
  • TLSH
    T1F0F6F0305E0169CC27B569F2A0E6A85C2C7007F3CF197D1B4984DCF79EFA9EC9AA6414
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2behavioral3