Overview

overview

8

Static

static

3

ratooon.exe

windows10-2004-x64

8

ratooon.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    ratooon.exe
  • Size 94KB
  • Sample260424-ng89vags5x
  • SHA256 b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecutionpersistence

Malware Config

Targets

    • Target
      ratooon.exe
    • Size 94KB
    • SHA256 b6a06f9799e05b4b4404a73f227da838ec9ba0e4cc6de376b04807897e55ddc6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks