Extracted

• • Target
    fastclients.exe
  • Size 38.1MB
  • SHA256 16f236ea5d43e61b21d1032fe9e76d8c7ce5c8642cecdf5466d7c8f8047fee90
  • MD5 54b1a9ca476c12a6b0c698defe83569f
  • SHA1 85675756ed065c9181ed360302e84767281c51a7
  • SHA512 12caab3eaa07db1b0c5bb00599a3d45e4238cc3e4e4b5c1c2246fd719aba2bbc3432ac0602bef10d32b8cff866d15f0eeb9f2a3db942559a155786f86627661c
  • SSDEEP 786432:DIJOEaXyqPZPQTcm59n/cZNmab9ntTncgelw73LzJ6S8LCvOi2Yq:DYbaiqiJ/yYa55clw7XJnECvOi2Yq
  • TLSH
    T1EA97332832E5CA1CE17F0FB0E5B2616A5A31FD0BDC61FF1971A2756D04B6F84A721A13
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionratonratpersistencespywarestealertrojan

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2