Extracted

• • Target
    ratonClient.bat
  • Size 4.0MB
  • SHA256 28496a67b890f3596b2b4519877d24a0d6abe382bf587d2776efd42f550301b8
  • MD5 99d11d2e06da78d51f0f4cb8b59e67a1
  • SHA1 95c166f645033e23b0011471e5ceffe236a6787f
  • SHA512 c7ee0ad0c0f0b19042c6a988e3c8e6204a1125569d807ae13b38af9078b67b083cafd6cfa0f45a97d0f6ac90d33a95eab73f89084bf13ad0dfe35e18ec6ddc54
  • SSDEEP 24576:suDak8wJ4Qu0QieoS39X0BOki7tY7rhuKytmmQn5gzYKIblTAHUqZsjHOynXNoSQ:a3V0Bpi1On+Y7r0mu8NWdBnYufJUi
  • TLSH
    T18316F132373D6DA78532ABCECCB0681A3CCE54530312AD14F8CE957AA5756C0BF2D966
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratspywarestealer

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  behavioral1behavioral2behavioral3