Extracted

• • Target
    Potassium Cracked.exe
  • Size 2.4MB
  • SHA256 164789dfcc67b61b2971ea6a0e084f4dda82c03d6e2f937026a94c56ad2d75fe
  • MD5 1172d6a0c7cb91bf965e7aeb7cd1f059
  • SHA1 92ab11d90d8fbc35ca8c5136664c732babeadc1b
  • SHA512 f965a9a2e77729e0a8e3d396303a9fc5614b04b8eb9ccdc3d94dd22c9b7c2443d27a7aeb394e9e12af0c21202c0ee21fda98cf8260339b0edad14bcac8442b0d
  • SSDEEP 49152:BgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4VAn4t:BgVUuHjkDGjYQDGuRxzew
  • TLSH
    T15BC5011C33F9C718F1AF4BF4A47189664771FD179C62DBAC58A139AE04B6F44AA10B23
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionratonratpersistencestealeradwareransomwarespyware

  • Detects RatonRAT payload

  • Family: RatonRAT

    RatonRAT is an information stealer written in C#.

    stealerratonrat

  • Renames multiple (168) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2