RatonRAT

Key Takeaways

• Credential and Data Theft: RatonRAT can steal credentials and collect system and hardware information from compromised Windows systems.
• Persistence Mechanisms: The malware uses scheduled tasks and Active Setup to maintain execution after user logon.
• Defense Evasion: RatonRAT can bypass PowerShell ExecutionPolicy and add its process to Microsoft Defender exclusions.
• System and VM Discovery: It checks running processes, privileges, BIOS and disk information, as well as VirtualBox and VMware environments.
• C2 Communication: After establishing itself, RatonRAT connects to a configured command-and-control server to receive further instructions.
• Configurable .NET Malware: The family uses a configurable .NET architecture and Costura/Fody to bundle its components.
• ANY.RUN’s Interactive Sandbox analysis reveals a sequence involving self-relocation, BAT-based execution, persistence, Defender exclusion, virtual environment checks, and subsequent C2 communication.

RatonRAT detonated inside ANY.RUN’s Interactive Sandbox

What is RatonRAT?

RatonRAT is a .NET-based Remote Access Trojan targeting Windows systems. The malware provides attackers with remote access to compromised hosts and supports capabilities including credential theft, system information collection, persistence, and security evasion.

The family is characterized by its configurable architecture and the use of Costura/Fody to package .NET components. This allows different samples to maintain a similar underlying structure while using customized configurations.

Observed samples also demonstrate a focus on maintaining access and reducing visibility after execution. The malware can relocate itself to an application-data directory, establish automatic startup mechanisms, modify Microsoft Defender exclusions, and communicate with a configured C2 server.

How RatonRAT Impacts Businesses and Organizations

A RatonRAT infection can create several risks for businesses and organizations:

• Credential exposure: The malware can collect credentials from compromised systems, potentially exposing access to corporate services and applications.
• Unauthorized remote access: As a RAT, RatonRAT provides attackers with a channel for remote control and further interaction with an infected endpoint.
• Persistence: Scheduled tasks and Active Setup entries can allow the malware to restart automatically after user logon or environment initialization.
• Security control bypass: Changes to Microsoft Defender exclusions can reduce endpoint protection visibility and allow the malware to continue operating.
• Reconnaissance: System, hardware, process, disk, BIOS, and privilege information can help attackers understand the compromised environment.
• Virtualization awareness: Checks for VirtualBox and VMware can allow the malware to identify analysis or virtualized environments.
• Follow-on activity: Once a C2 connection is established, additional behavior depends on the commands received by the infected client.

Victimology: Who Can Be Affected?

RatonRAT targets Windows systems, making organizations that rely on Windows workstations and endpoints potentially exposed to the malware.

Its capabilities are not limited to a particular industry. Credential collection, system reconnaissance, persistence, and remote access are broadly applicable to attacks against corporate endpoints.

Because RatonRAT can receive instructions from a configured C2 server, the activity performed after infection may vary between samples and campaigns.

How Does RatonRAT Function?

Observing a RatonRAT sample inside ANY.RUN’s Interactive Sandbox shows a sequence focused on establishing a stable execution location, creating persistence, weakening endpoint protections, collecting information about the environment, and contacting the C2 server.

The general execution flow begins with the initial executable relocating itself, followed by BAT-based execution, persistence, security evasion, system reconnaissance, and C2 communication.

RatonRAT analysis in ANY.RUN’s Interactive Sandbox

Stage 1: Self-Relocation and BAT Creation

Immediately after execution, an observed RatonRAT sample copies itself into: %APPDATA%\Roaming\PlatformRuntime\

The malware also creates a BAT file inside: %APPDATA%\Roaming\Temp\

The BAT filename frequently follows a pattern similar to: cleanup_[a-z0-9]{30}.bat

The exact filename and script contents can vary between samples, but the overall structure remains similar.

The BAT script uses helper commands through cmd.exe and timeout.exe. It launches the relocated executable and attempts to remove the original executable from the desktop, helping the malware continue execution from its new location while cleaning up traces of the initial file.

RatonRAT creating a BAT launcher and relocating itself

Stage 2: BAT-Based Execution

The newly created BAT file is subsequently executed. Its primary purpose is to start the copied RatonRAT executable from the %APPDATA%\Roaming\PlatformRuntime\ directory.

The script also performs cleanup operations intended to remove traces of the original executable.

This creates an execution sequence in which the initial file is no longer the main execution location:

Original executable → BAT script → relocated RatonRAT copy

Stage 3: Establishing Persistence

After launching from its new location, RatonRAT proceeds to establish persistence.

One observed mechanism is a scheduled task configured to launch the malicious executable when the user logs in. The task can be created with elevated privileges, allowing the malware to regain execution automatically after login.

RatonRAT creating a scheduled task for persistence

Some samples use a different persistence mechanism based on Active Setup rather than a scheduled task. Active Setup allows a component to execute automatically when the user's environment is initialized.

This variation demonstrates that persistence behavior can differ between RatonRAT samples while serving the same purpose: maintaining execution after the initial compromise.

RatonRAT using Active Setup to establish persistence

Stage 4: PowerShell and Microsoft Defender Evasion

After persistence is established, RatonRAT launches PowerShell with an ExecutionPolicy bypass.

The malware also attempts to add its process to Microsoft Defender exclusions. This can reduce the ability of the endpoint security product to inspect or block the malicious process.

RatonRAT bypassing PowerShell ExecutionPolicy

The combination of PowerShell execution and security-control modification represents an important behavioral signal for defenders investigating suspicious activity on Windows endpoints.

RatonRAT modifying Microsoft Defender exclusions

Stage 5: System and Virtual Environment Discovery

RatonRAT then collects information about the environment in which it is running.

Observed checks include:

• VirtualBox indicators
• VMware indicators
• BIOS information
• Disk information
• Running processes
• Available privileges
• System and hardware characteristics

The virtualization checks can help the malware determine whether it is operating inside a virtualized or potentially analyzed environment.

RatonRAT checking for virtualization and system information

Stage 6: Mutex Creation

Another characteristic observed during execution is the creation of randomly generated mutexes.

These mutex names vary between executions and samples, but their purpose is consistent with preventing multiple instances of the malware from running simultaneously or helping the malware coordinate its execution state.

RatonRAT creating a randomly generated mutex

Stage 7: C2 Communication

Once the malware is running from its intended directory, RatonRAT establishes network communication with its configured C2 server.

This connection provides the attacker with a channel for controlling the infected client and delivering further instructions.

RatonRAT communicating with its configured C2 server

The subsequent behavior depends on the commands received by the RatonRAT client. As a result, activity observed after the initial C2 connection can vary between infections.

RatonRAT Behavior at a Glance

The observed samples demonstrate several layers of activity designed to maintain execution and reduce the malware's visibility:

• Relocation moves the executable from its original location into %APPDATA%\Roaming\PlatformRuntime.
• BAT execution launches the relocated copy and attempts to remove the original file.
• Persistence is established through scheduled tasks or Active Setup.
• PowerShell is used with an ExecutionPolicy bypass.
• Defender exclusions are modified to reduce security-tool interference.
• Environment discovery collects system, hardware, process, privilege, and virtualization information.
• Mutexes are created using randomized names.
• C2 communication enables further remote instructions.

This combination gives RatonRAT multiple opportunities to survive execution, understand its environment, and maintain communication with its operator.

How Organizations Can Use ANY.RUN’s Threat Intelligence to Investigate RatonRAT

RatonRAT samples can vary in configuration, persistence mechanisms, filenames, and infrastructure. For this reason, relying exclusively on static indicators such as file hashes may provide limited visibility into related activity.

ANY.RUN’s Threat Intelligence can help analysts connect individual RatonRAT samples with related infrastructure, behavioral artifacts, and previous sandbox executions.

Threat Intelligence Lookup can be used to investigate known RatonRAT indicators and identify related artifacts.

threatName:"raton"

Searching for RatonRAT in ANY.RUN’s TI Lookup

Identify Behavioral Indicators

Defenders investigating potential RatonRAT activity can monitor for combinations of behaviors such as:

• Executables copying themselves into %APPDATA%\Roaming\PlatformRuntime\
• BAT files created under %APPDATA%\Roaming\Temp\
• BAT filenames matching cleanup_[a-z0-9]{30}.bat
• cmd.exe and timeout.exe launched by suspicious scripts
• Newly created scheduled tasks launching executables from user-writable directories
• Active Setup entries associated with unexpected executables
• PowerShell launched with an ExecutionPolicy bypass
• Unexpected modifications to Microsoft Defender exclusions
• VirtualBox or VMware environment checks by suspicious processes
• Unusual BIOS, disk, process, or privilege discovery
• Randomly generated mutex creation
• Unexpected outbound connections to configured C2 infrastructure

Behavioral detection can be particularly useful because individual RatonRAT samples may use different filenames, configurations, or persistence mechanisms.

Powered by data contributed by 16,000 organizations and 700,000 security professionals, fresh ANY.RUN’s Threat Intelligence Feeds provide SOC teams with current indicators linked to RatonRAT activity. Feeds can be integrated with SIEM, SOAR, and EDR platforms, and other security solutions to help analysts detect suspicious infrastructure, investigate related activity, and track changes in the threat landscape.

Threat intelligence from 16K SOCs and 700K analysts

Connect Samples to Related Activity

Analysts can use ANY RUN’s Threat Intelligence Lookup to pivot from a suspicious sample or indicator toward related activity.

For example, an investigation can begin with a suspicious executable and expand to:

• Related RatonRAT samples
• Shared hashes and artifacts
• C2 infrastructure
• Similar BAT launchers
• Persistence mechanisms
• PowerShell activity
• Common configuration characteristics
• Previous sandbox executions

This approach can help analysts determine whether an isolated endpoint event is connected to broader RatonRAT activity.

Respond to a RatonRAT Infection

If RatonRAT is identified on a corporate endpoint, incident response should address both the compromised host and any credentials or sessions that may have been exposed.

Recommended actions include:

• Isolate the affected endpoint.
• Preserve relevant forensic evidence.
• Remove unauthorized persistence mechanisms.
• Reset credentials that may have been exposed.
• Revoke active sessions where appropriate.
• Review authentication logs for suspicious activity.
• Investigate Microsoft Defender exclusion changes.
• Search for related BAT files, scheduled tasks, Active Setup entries, and suspicious PowerShell activity.
• Identify and block associated C2 infrastructure where appropriate.
• Search other endpoints for matching behavioral indicators.

As RatonRAT can maintain persistence and communicate with a C2 server, removing the initial executable alone may not be sufficient to determine whether the system remains compromised.

Conclusion

RatonRAT demonstrates how a relatively compact Windows RAT can combine persistence, system reconnaissance, credential theft, defense evasion, and C2 communication into a single infection chain.

Observed samples relocate themselves, use BAT scripts for execution and cleanup, establish persistence through scheduled tasks or Active Setup, modify Microsoft Defender exclusions, inspect the host environment, and communicate with a configured C2 server.

For defenders, these behaviors provide multiple opportunities for detection. Monitoring persistence creation, suspicious PowerShell activity, Defender exclusion changes, user-writable execution paths, virtualization checks, and unexpected C2 communication can help identify RatonRAT activity beyond simple hash-based detection.

Frequently Asked Questions: RatonRAT

1. What is RatonRAT?

RatonRAT is a .NET-based Remote Access Trojan targeting Windows systems. It supports capabilities including credential theft, system information collection, persistence, security evasion, and remote communication with a C2 server.

2. What can RatonRAT do?

RatonRAT can collect credentials and system information, establish persistence, inspect the host environment, evade certain security controls, and communicate with an attacker-controlled C2 server for further instructions.

3. How does RatonRAT establish persistence?

Observed samples can create a scheduled task that launches the malware at user logon. Some variants instead use an Active Setup entry to automatically execute a component during user-environment initialization.

4. How can RatonRAT evade detection?

RatonRAT can launch PowerShell with an ExecutionPolicy bypass and add its process to Microsoft Defender exclusions. It also checks for virtualized environments and uses self-relocation and cleanup scripts to reduce traces of its initial execution.

5. What does RatonRAT check on an infected system?

Observed samples inspect BIOS and disk information, running processes, system and hardware characteristics, available privileges, and virtualization indicators associated with VirtualBox and VMware.

6. How can interactive sandboxing and threat intelligence help investigate RatonRAT?

Interactive sandboxing allows analysts to observe the malware's behavior in a controlled environment, including self-relocation, BAT execution, persistence creation, PowerShell activity, Defender exclusion changes, environment discovery, mutex creation, and C2 communication.

Threat intelligence can then be used to pivot from observed indicators to related samples and infrastructure.