Derp.ca
Data by Hatching Triage opens in a new tab

RatonRAT

Profile source: Mallory opens in a new tab

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Observed infrastructure

Last seven days

First activity
Jul 31, 2026
Last activity
Aug 7, 2026
Feed role
C2 / Distribution
Host form
31 IP / 13 hostnames

Leading locations

  • DE9
  • NL8
  • US8
  • LU4
  • RU4
  • GB3
  • PL2
  • SE2
  • AE1
  • BR1
  • HK1
  • IN1

Leading providers

  • DigitalOcean, LLC4
  • Ghosty Networks LLC4
  • Omegatech LTD4
  • DEDIK SERVICES LIMITED3
  • HostPapa3
  • Amazon.com, Inc.2

Infrastructure traits

  • Hosting 40

Samples

Recent associated samples

4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Observed Aug 7, 2026Triage
6747147c5ba29975a557d88cd22114478890a0a0a613f36512dcb730e4efe965
Observed Aug 7, 2026Triage
944a6ff7edb3991a3f60e19d26f23ad21054adc53109cfcdbb5d101a84a7971b
Observed Aug 7, 2026Triage
dd17e871204619a3de34126e366221b64e684ec13e24dfc871698abe343acbff
Observed Aug 7, 2026Triage
fbf4ef28c4b49c6304d23a738afabf8981590eae8585834bf24e3c7e87163c1a
Observed Aug 7, 2026Triage
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Observed Aug 6, 2026Triage
30955adfb864533f1d6a46b25f02aa79c5c5891d0b536eb9da9d33bcaa1061db
Observed Aug 6, 2026Triage
7fe76ccceaec33d07e90e96ac144be83ed622c8af8b134d7429020e476cf4716
Observed Aug 6, 2026Triage
8e2b78e7c586e36dc3b27c78466fad735f86cdd9b4e7ecbc4c650d934a9a176b
Observed Aug 6, 2026Triage
b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49
Observed Aug 6, 2026Triage

MITRE ATT&CK

RatonRAT in ATT&CK

22 distinct techniques

Techniques

22 techniques
T1568 Dynamic Resolution T1059.001 PowerShell T1091 Replication Through Removable Media T1204.002 Malicious File T1547.001 Registry Run Keys / Startup Folder T1657 Financial Theft T1528 Steal Application Access Token T1053.005 Scheduled Task T1090 Proxy T1486 Data Encrypted for Impact T1113 Screen Capture T1123 Audio Capture T1548.002 Bypass User Account Control T1562.001 Disable or Modify Tools T1041 Exfiltration Over C2 Channel T1056.001 Keylogging T1555.003 Credentials from Web Browsers T1115 Clipboard Data T1498 Network Denial of Service T1027.009 Embedded Payloads T1529 System Shutdown/Reboot T1071 Application Layer Protocol

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab