MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 f90fa08e9fdabf2c8c38a3f1651db766f97402f18fac8947ffcc45de93454c08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RatonRAT
Vendor detections: 16
| SHA256 hash: | f90fa08e9fdabf2c8c38a3f1651db766f97402f18fac8947ffcc45de93454c08 |
|---|---|
| SHA3-384 hash: | d0b43d6fd6ee7a4c65c6a7e78813884571910cffc9610dc9a495fdfcc6a7cfb8b7e9e7dc48178a205255fe76fe34b05c |
| SHA1 hash: | 326f1c9e544715f80bfa7b04673b6a47c042d3ed |
| MD5 hash: | 057e51cdbb1209601ad334ade2297792 |
| humanhash: | autumn-freddie-moon-edward |
| File name: | 057e51cdbb1209601ad334ade2297792.exe |
| Download: | download sample |
| Signature | RatonRAT |
| File size: | 2'510'848 bytes |
| First seen: | 2026-10-19 16:25:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/vnd.microsoft.portable-executable |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (49'291 x AgentTesla, 20'706 x Formbook, 12'401 x SnakeKeylogger) |
| ssdeep | 49152:kgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4iAn4g:kgVUuHjkDGjYQDGuRxzew |
| TLSH | T13BC5011C33F9C618F2AF4BB4A57189664731FC179C52DBAC58E139AE14B6F44BA10B23 |
| TrID | 49.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 29.3% (.EXE) InstallShield setup (43053/19/16) 4.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.4% (.EXE) Win64 Executable (generic) (6522/11/2) 3.4% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| Magika | pebin |
| dhash icon | d2b2f1544c4cd4f8 (1 x RatonRAT) |
| Reporter |  abuse_ch |
| Tags: | exe ratonrat |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 83.9.65.197:8080 | https://threatfox.abuse.ch/ioc/1974448/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
193
Origin country :
NLVendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-19 17:16:12 UTC
Tags:
installer raton rat auto-sch stealer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
99.9%
Tags:
clipbanker vmdetect emotet
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating synchronization primitives
Creating a file in the %temp% subdirectories
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
Running batch commands
Launching a process
Creating a file
Creating a process from a recently created file
Loading a suspicious library
Using the Windows Management Instrumentation requests
Creating a window
Connection attempt
Sending a custom TCP request
DNS request
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-vm anti-vm base64 bitmap cmd cscript evasive explorer findstr fingerprint fingerprint hacktool lolbin netsh obfuscated obfuscated packed packed packer pnputil privilege reconnaissance regasm rundll32 schtasks stego update vbnet venomrat wscript
Verdict:
Malicious
Labled as:
Adware.Marsilia.Generic
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-15T08:38:00Z UTC
Last seen:
2026-10-21T03:50:00Z UTC
Hits:
~10
Verdict:
Malicious
Result
Threat name:
KeyLogger, RatonRAT
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contains functionality to capture screen (.Net source)
Contains functionality to disable the Task Manager (.Net Source)
Contains functionality to log keystrokes (.Net Source)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Self deletion via cmd or bat file
Suricata IDS alerts for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Costura Assembly Loader
Yara detected Keylogger Generic
Yara detected Raton RAT
Behaviour
Behavior Graph:
Score:
98%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
17 match(es)
Tags:
.Net Executable Fody/Costura Packer Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.15 SOS: 0.18 SOS: 0.19 SOS: 0.20 SOS: 0.22 SOS: 0.23 SOS: 0.25 SOS: 0.28 SOS: 0.29 SOS: 0.30 SOS: 0.36 Win 32 Exe x86
Threat name:
ByteCode-MSIL.Infostealer.ClipBanker
Status:
Malicious
First seen:
2026-10-18 06:08:49 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
33 of 38 (86.84%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
RatonRAT
Result
Malware family:
ratonrat
Score:
10/10
Tags:
family:ratonrat defense_evasion discovery execution persistence stealer
Behaviour
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Executes dropped EXE
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Detects RatonRAT payload
Family: RatonRAT
Malware Config
C2 Extraction:
83.9.65.197:8080
Unpacked files
SH256 hash:
f90fa08e9fdabf2c8c38a3f1651db766f97402f18fac8947ffcc45de93454c08
MD5 hash:
057e51cdbb1209601ad334ade2297792
SHA1 hash:
326f1c9e544715f80bfa7b04673b6a47c042d3ed
Detections:
cn_utf8_windows_terminal
INDICATOR_EXE_Packed_Fody
INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
INDICATOR_SUSPICIOUS_Binary_References_Browsers
INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender
SH256 hash:
9ef70cb7efa87b5141b81315a85800c92849654b6132fdc93d0ad993d9ede379
MD5 hash:
e857fc4f9c70f7081d76efbbbb0069a8
SHA1 hash:
e3a380fe1f5b38005138daa56f0105de304d2551
SH256 hash:
a40a50abd6975357ca67a68461f2071b2f2fae9a5215350497bbefff941953a4
MD5 hash:
1ec1c5856690452f5a502ffc9d0e4e76
SHA1 hash:
1116aa4f6321f55530db982bba78eb04995ae549
SH256 hash:
b58a822e5bdfca93ec38bc481bc00a5ad38cfe4103526421ab28d346791a2a09
MD5 hash:
86c5cf90b1d2847b7df60ce79c2145d6
SHA1 hash:
084c6ec381d1125dc02cee5b97cf7f468f48976a
SH256 hash:
6bf97a2837c894f10012c2889c064ed07b698581296839035f663dfd82bcd3b4
MD5 hash:
41741d072f1db7f9bd854f5ae3d1c5dc
SHA1 hash:
0ee05639220264482a0fd8133371c2cb7820f4b6
SH256 hash:
9a8a052648e8cc68052fc24bdc7622653c1aba463eca0d1cf73fa48d7188158c
MD5 hash:
8c3e2f3ea10a59aacff7294583880618
SHA1 hash:
12af46037aa90c2582c2d91ff01705909064f6ed
SH256 hash:
d5235265564f0bfd23b7279d7bdccc9ea6383ed07c5d0bfdf6c99029af9a2c0c
MD5 hash:
1d3dd9fcc077e6b4f88c05b9aef53ee6
SHA1 hash:
12b33858bc84f54b8aa8dbcb5a0ec2da043a6f66
SH256 hash:
7796a9ec97a1ff29e682855839845da9fe26b6ddcc34addbb514cd73e7a9f02a
MD5 hash:
f6940019dad6c782bcb645c2f7d52db5
SHA1 hash:
1bbe492757bf99840d923fdd44c6a3f34b336cf7
SH256 hash:
7350c7e33c79bbc36c67bf4ef27f39a2ff9e2886d3ebc15d021b342c9d2b4ea2
MD5 hash:
9d3cf388766b2c32f1e5e1de4d9c8578
SHA1 hash:
39a81a49e10e9bcf2b3a470962ebbe1cf42cd8f4
SH256 hash:
5dca4b3b7f1f2abdd2f94d3a056e4c414605da248612f02a0d2ab38083aa8ef8
MD5 hash:
e90ac3063409ef6876e26422dc61d0eb
SHA1 hash:
3cd158d0f9a4f9a78a7ae56ecb0df0360a413181
SH256 hash:
2f1725d05b424f154f931a3c96a14318d48da2297c12fb33b384786a9a70f717
MD5 hash:
f6aa556b07dcfb7d3105e1eab11f8162
SHA1 hash:
44a66ea7c6d0e456006515226a03a31862f5b52a
SH256 hash:
d8ee0fc96ce8de2e37bc8fdc051da7c1852b9a510270e663ba17281de23f049b
MD5 hash:
f8d5274e3368aa40cc0fd5798d19c783
SHA1 hash:
87f87d8c2b468fb87d82c3f5a849936c08d7a67c
SH256 hash:
3c8359bb74c6dabd2ec8ba561ffa163f24859ff5aef724fb5794073e2e883a02
MD5 hash:
c1b78af3d6402be8f259dbbe9250e7fb
SHA1 hash:
98e2c38597c50390852801d46ff342889c7351ae
SH256 hash:
e23a68cc89a4a402260cddb8bb6ead50b8d189bee6eca1ef6a95857560f6a231
MD5 hash:
64a66a36c3107a7a4042270bb9569d28
SHA1 hash:
a8996313a73f189135caa0bcd11e786d523962a7
SH256 hash:
fae06a2e756e6332df98f16991a0183bd61fbe83a015d83d4518461c120977a7
MD5 hash:
1494a1cde33c013757b4f397a727d372
SHA1 hash:
c384672f7c7946637f9684e36b406a28f5f8f7ed
SH256 hash:
82a92cb6b9001e013c653c65e4ae460346770ec7512856879e63018d9cafc41a
MD5 hash:
115137414b41a26d6e73738cd94c036c
SHA1 hash:
e9e87ec6227bc9d8a971d2aa687dcd4e392a8d43
SH256 hash:
d838c40848daf87743e96d42f8db18bb66a0b27cff5a48926a85a61c2d3e05b9
MD5 hash:
0bfef61b203054f6fbf08419ffe3f018
SHA1 hash:
ed9d0418507630996eb2c473ec5daf11d185c2c6
Malware family:
ShitRAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_Qemu_Description |
|---|
| Rule name: | Check_Qemu_DeviceMap |
|---|
| Rule name: | Check_VBox_Description |
|---|
| Rule name: | Check_VBox_DeviceMap |
|---|
| Rule name: | Check_VBox_Guest_Additions |
|---|
| Rule name: | Check_VmTools |
|---|
| Rule name: | Check_VMWare_DeviceMap |
|---|
| Rule name: | CP_Script_Inject_Detector |
|---|---|
| Author: | DiegoAnalytics |
| Description: | Detects attempts to inject code into another process across PE, ELF, Mach-O binaries |
| Rule name: | DetectEncryptedVariants |
|---|---|
| Author: | Zinyth |
| Description: | Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded |
| Rule name: | Disable_Defender |
|---|---|
| Author: | iam-py-test |
| Description: | Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen |
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
| Rule name: | grakate_stealer_nov_2021 |
|---|
| Rule name: | INDICATOR_EXE_Packed_Fody |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables manipulated with Fody |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs |
|---|---|
| Author: | ditekSHen |
| Description: | Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. |
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Windows executables referencing non-Windows User-Agents |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers |
| Rule name: | INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables embedding registry key / value combination indicative of disabling Windows Defender features |
| Rule name: | Macos_Infostealer_Wallets_8e469ea0 |
|---|---|
| Author: | Elastic Security |
| Rule name: | Multifamily_RAT_Detection |
|---|---|
| Author: | Lucas Acha (https://www.lukeacha.com) |
| Description: | Generic detection for multiple RAT families, PUPs, packers and suspicious executables. NOTE: This rule may produce false positives. Updated May 2026 to reduce False Positives. |
| Rule name: | NET |
|---|---|
| Author: | malware-lu |
| Rule name: | Njrat |
|---|---|
| Author: | botherder https://github.com/botherder |
| Description: | Njrat |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | Sus_CMD_Powershell_Usage |
|---|---|
| Author: | XiAnzheng |
| Description: | May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP) |
| Rule name: | telebot_framework |
|---|---|
| Author: | vietdx.mb |
| Rule name: | ThreadControl__Context |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | vmdetect |
|---|---|
| Author: | nex |
| Description: | Possibly employs anti-virtualization techniques |
| Rule name: | WIN_Malware_Derialock_ForgeAuto_3127f957_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects Derialock (pe, etat extrait) |
| Rule name: | WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait |
|---|---|
| Author: | Marjoriefort |
| Description: | Detects XWorm (pe, etat extrait) |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.