Overview

overview

10

Static

static

10

ratonClient.exe

windows10-2004-x64

10

ratonClient.exe

windows11-ltsc_2024-x64

10

aforge.dll

windows10-2004-x64

1

aforge.dll

windows11-ltsc_2024-x64

1

aforge.vid...ow.dll

windows10-2004-x64

1

aforge.vid...ow.dll

windows11-ltsc_2024-x64

1

aforge.video.dll

windows10-2004-x64

1

aforge.video.dll

windows11-ltsc_2024-x64

1

costura.dll

windows10-2004-x64

1

costura.dll

windows11-ltsc_2024-x64

1

microsoft....ry.dll

windows10-2004-x64

1

microsoft....ry.dll

windows11-ltsc_2024-x64

1

naudio.asio.dll

windows10-2004-x64

1

naudio.asio.dll

windows11-ltsc_2024-x64

1

naudio.core.dll

windows10-2004-x64

1

naudio.core.dll

windows11-ltsc_2024-x64

1

naudio.dll

windows10-2004-x64

1

naudio.dll

windows11-ltsc_2024-x64

1

naudio.midi.dll

windows10-2004-x64

1

naudio.midi.dll

windows11-ltsc_2024-x64

1

naudio.wasapi.dll

windows10-2004-x64

1

naudio.wasapi.dll

windows11-ltsc_2024-x64

1

naudio.winforms.dll

windows10-2004-x64

1

naudio.winforms.dll

windows11-ltsc_2024-x64

1

naudio.winmm.dll

windows10-2004-x64

1

naudio.winmm.dll

windows11-ltsc_2024-x64

1

newtonsoft.json.dll

windows10-2004-x64

1

newtonsoft.json.dll

windows11-ltsc_2024-x64

1

stuff.dll

windows10-2004-x64

1

stuff.dll

windows11-ltsc_2024-x64

1

system.buffers.dll

windows10-2004-x64

1

system.buffers.dll

windows11-ltsc_2024-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/11/2026, 02:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ratonClient.exe
  • Size 2.8MB
  • Sample261111-c4pm6sdg25
  • SHA256 1dd4583041678750db57c1ddc12ee8ee6d0894333200cf816af250cbcacf1f78
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
discoveryratonratstealer

Malware Config

Extracted

Family

  • ratonrat

Version

  • Free

C2

  • h5yy5tyq34t.localto.net:5101

Mutex

  • 5w2RH8MYbGDAOxcz2H7PaXg

Attributes
  • assist

    false

  • box

    false

  • box_icon

    No icon

  • box_msg

    Hello, i'm the description of your raton client message box

  • box_title

    Hello, im a title for your message box

  • defender

    false

  • delay

    0

  • hide_file

    false

  • open_website

    false

  • process_critical

    false

  • raw

    silly21

  • reconnect

    3

  • startup

    false

  • tag

    Infected

  • uac

    false

  • vm

    false

  • website

    https://t.me/sillyisafed

Signatures

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat
  • Detects RatonRAT payload 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ratonClient.exe
    "C:\Users\Admin\AppData\Local\Temp\ratonClient.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aforge.video.directshow.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\aforge.video.directshow.dll
        • Size 60KB
        • SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        naudio.core.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.core.dll
        • Size 183KB
        • SHA256 4f8d8c4140146674b103c8a3c46fbc4c768a86c0012a167168e3f7da2b3e5c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        naudio.wasapi.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.wasapi.dll
        • Size 176KB
        • SHA256 a05e371abf96195770ac4f84653d987d63731fed528e98c7fe0d10ce66e37d7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        naudio.winforms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winforms.dll
        • Size 33KB
        • SHA256 82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        naudio.winmm.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\naudio.winmm.dll
        • Size 56KB
        • SHA256 3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        newtonsoft.json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\newtonsoft.json.dll
        • Size 704KB
        • SHA256 f0c07af0e84d4dd4da4bd7823ba4535bc0481b3bf623ed40b659b68147a6bb75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        stuff.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\stuff.dll
        • Size 12KB
        • SHA256 d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        system.buffers.dll
        • Path C:\Users\Admin\AppData\Local\Temp\Costura\43C0B7C2D694D39E487F61CFD3964734\system.buffers.dll
        • Size 20KB
        • SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4284-76-0x000001477E3B0000-0x000001477E3CA000-memory.dmp
        Download

        memory/4284-85-0x000001477E1C0000-0x000001477E1CE000-memory.dmp
        Download

        memory/4284-55-0x000001477E1D0000-0x000001477E284000-memory.dmp
        Download

        memory/4284-63-0x000001477E160000-0x000001477E16A000-memory.dmp
        Download

        memory/4284-27-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-70-0x000001477E3D0000-0x000001477E402000-memory.dmp
        Download

        memory/4284-37-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-78-0x000001477E390000-0x000001477E3A6000-memory.dmp
        Download

        memory/4284-2-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-61-0x000001477E170000-0x000001477E192000-memory.dmp
        Download

        memory/4284-1-0x0000014779BA0000-0x0000014779E76000-memory.dmp
        Download

        memory/4284-0-0x00007FFF376FF000-0x00007FFF37700000-memory.dmp
        Download

        memory/4284-92-0x000001477E450000-0x000001477E484000-memory.dmp
        Download

        memory/4284-48-0x000001477DBA0000-0x000001477DBAA000-memory.dmp
        Download

        memory/4284-99-0x000001477E430000-0x000001477E444000-memory.dmp
        Download

        memory/4284-105-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-106-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-107-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download

        memory/4284-108-0x00007FFF37570000-0x00007FFF37F14000-memory.dmp
        Download