🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RatonRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac
SHA3-384 hash: b3bf7658822dcb03b4391349eb3906fcbb60f1dc6da162244693ad7a584ebb0716a977f0962941bd1e6d2e6d69493248
SHA1 hash: 5dac53ef5c623c6c9d40129789624e73846e909b
MD5 hash: e3be0e04e34dddc5052c76b445924ffb
humanhash: yellow-violet-william-social
File name:platz-optimizer.bat
Download: download sample
Signature RatonRAT
Create hunting rule
File size:7'349'779 bytes
First seen:2026-03-02 08:48:15 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 49152:eq8VIJqUrxsDIQ9FUTvBM7bbDkfSvJXnia7CNi3YI:y
TLSH T1F476E3313B2EADA7D632AACEDDF4558A3CCE2903031AAD54F9CE903590753C06F5D866
Magika batch
Reporter abuse_ch
Tags:bat RAT ratonrat

Intelligence

File Origin
# of uploads :
1
# of downloads :
139
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f0cb1ef5-4d9a-4b8c-8c1d-bfa95af7530b/
Malware family:
n/a
ID:
1
File name:
platz-optimizer.bat
Verdict:
Malicious activity
Analysis date:
2026-02-28 20:49:43 UTC
Tags:
auto-reg stealer
Link:
https://app.any.run/tasks/10f35ea1-a2a8-4cf5-813e-4161dff552a3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/55181/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69a354e28fffa866e3b36995
Tags:
vmdetect emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Delayed reading of the file
Delayed writing of the file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm base64 base64 obfuscated
Link:
https://www.filescan.io/uploads/69a54f0bc58f45aa750fbad8/reports/da15c85c-216a-4806-8dbe-ea4ad45ac569/overview
Verdict:
Suspicious
Labled as:
TrojanDropper/BAT.Agent
Link:
https://www.hybrid-analysis.com/sample/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac
Verdict:
Clean
File Type:
text
Link:
https://opentip.kaspersky.com/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac/results?tab=lookup
Result
Threat name:
RatonRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1876650
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Disables UAC (registry)
Disables Windows system restore
Found large BAT file
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Sigma detected: Legitimate Application Dropped Executable
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Raton RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1876650 Sample: platz-optimizer.bat Startdate: 02/03/2026 Architecture: WINDOWS Score: 100 66 fvab7zwbj.localto.net 2->66 80 Found malware configuration 2->80 82 Yara detected Raton RAT 2->82 84 Yara detected AntiVM3 2->84 86 6 other signatures 2->86 12 cmd.exe 2 2->12         started        15 optimizer.exe 2->15         started        signatures3 process4 signatures5 100 Uses cmd line tools excessively to alter registry or file data 12->100 17 ratonBinded.exe 5 12->17         started        21 certutil.exe 3 2 12->21         started        23 conhost.exe 12->23         started        process6 file7 60 C:\Users\user\AppData\...\optimizer.exe, PE32 17->60 dropped 74 Antivirus detection for dropped file 17->74 25 optimizer.exe 5 17->25         started        29 cmd.exe 2 17->29         started        62 C:\Users\user\AppData\...\ratonBinded.exe, PE32 21->62 dropped 76 Found many strings related to Crypto-Wallets (likely being stolen) 21->76 78 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->78 signatures8 process9 file10 64 C:\Users\user\AppData\...\optimizer.exe, PE32 25->64 dropped 88 Antivirus detection for dropped file 25->88 90 Multi AV Scanner detection for dropped file 25->90 31 cmd.exe 1 25->31         started        92 Uses cmd line tools excessively to alter registry or file data 29->92 33 reg.exe 1 1 29->33         started        36 reg.exe 1 29->36         started        38 cmd.exe 1 29->38         started        40 6 other processes 29->40 signatures11 process12 signatures13 42 optimizer.exe 2 31->42         started        46 conhost.exe 31->46         started        48 timeout.exe 1 31->48         started        54 2 other processes 31->54 70 Disables Windows system restore 33->70 72 Disables UAC (registry) 36->72 50 WMIC.exe 1 38->50         started        52 findstr.exe 1 38->52         started        process14 dnsIp15 68 fvab7zwbj.localto.net 89.163.135.20, 49692, 49693, 49694 MYLOC-ASIPBackboneofmyLocmanagedITAGDE Germany 42->68 94 Antivirus detection for dropped file 42->94 96 Multi AV Scanner detection for dropped file 42->96 98 Uses schtasks.exe or at.exe to add and modify task schedules 42->98 56 schtasks.exe 1 42->56         started        signatures16 process17 process18 58 conhost.exe 56->58         started       
Score:
74%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vlm6d74astpvw3rmxpklutpsy5i3sbdkycj2xc3s4kweus2fdcwa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
defense_evasion execution persistence trojan
Link:
https://tria.ge/reports/260302-kq45pset7a/
Behaviour
Delays execution with timeout.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Command and Scripting Interpreter: PowerShell
Deobfuscate/Decode Files or Information
Executes dropped EXE
UAC bypass
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/aad9e1ff8094df5b6e2cbbd4ba4df2c751b9046ac093ab8b72e2ac4a4b4518ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:ClamAV_Emotet_String_Aggregate
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/55181/

Comments