Derp.ca
Data by Hatching Triage opens in a new tab

RatonRAT

Profile source: Mallory opens in a new tab

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Observed infrastructure

Last seven days

First activity
Sep 12, 2026
Last activity
Sep 18, 2026
Feed role
C2 / Distribution
Host form
26 IP / 17 hostnames

Leading locations

  • DE11
  • GB6
  • NL6
  • US5
  • FR3
  • LU2
  • RU2
  • BR1
  • CA1
  • CN1
  • IN1
  • LT1

Leading providers

  • FEMO IT SOLUTIONS LIMITED6
  • OOO GETWIFI6
  • Free SAS2
  • Omegatech LTD2
  • TechTies Inc.2
  • WIIT AG2

Infrastructure traits

  • Hosting 29
  • Anycast 1
  • Proxy 1

Samples

Recent associated samples

052f0caff530a67f9a17df5795806d9b01a551f309e434cd4eb92fba8e024051
Observed Sep 18, 2026Triage
28e985edba59127261da83fe963b0a3674d9007840acd8db505fec6ac455c987
Observed Sep 18, 2026Triage
50a6bc7170cb47da6bb1206ad4d0997ccbeac2980e2e95552866981551db91e9
Observed Sep 18, 2026Triage
e80d37143b54b81a5d54a251cc7a317497e92a399c5f18ca506d01683b04903f
Observed Sep 18, 2026Triage
f97cff6d105693b7f7dcfa057c06f1ef00a2d42a01fb2fae000608c97ac94ae8
Observed Sep 18, 2026Triage
181b80c3a23bc369270a50c892104d258aa0805ea03efadc8e4eb3317ae23417
Observed Sep 18, 2026Triage
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Observed Sep 18, 2026Triage
7fbb661c45d9a60c7ae1f57be86a7c0de3a9f95b5aea7aba04f0aeba593d961c
Observed Sep 18, 2026Triage
dcbac3ed0476817570740b125b985ff116d0784f65c283c0ab360486e36a2021
Observed Sep 18, 2026Triage
fa447a729648caf9da7cbf60e3db9eb0d9e70411e7dee51e47f9d1477f9bdcb0
Observed Sep 18, 2026Triage

MITRE ATT&CK

RatonRAT in ATT&CK

22 distinct techniques

Techniques

22 techniques
T1568 Dynamic Resolution T1059.001 PowerShell T1091 Replication Through Removable Media T1204.002 Malicious File T1547.001 Registry Run Keys / Startup Folder T1657 Financial Theft T1528 Steal Application Access Token T1053.005 Scheduled Task T1090 Proxy T1486 Data Encrypted for Impact T1113 Screen Capture T1123 Audio Capture T1548.002 Bypass User Account Control T1562.001 Disable or Modify Tools T1041 Exfiltration Over C2 Channel T1056.001 Keylogging T1555.003 Credentials from Web Browsers T1115 Clipboard Data T1498 Network Denial of Service T1027.009 Embedded Payloads T1529 System Shutdown/Reboot T1071 Application Layer Protocol

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab