Derp.ca
Data by Hatching Triage opens in a new tab

RatonRAT

Profile source: Mallory opens in a new tab

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Observed infrastructure

Last seven days

First activity
Jul 29, 2026
Last activity
Aug 4, 2026
Feed role
C2 / Distribution
Host form
34 IP / 17 hostnames

Leading locations

  • DE13
  • NL9
  • US9
  • RU5
  • GB3
  • LU3
  • MD2
  • PL2
  • BR1
  • HK1
  • SE1

Leading providers

  • DigitalOcean, LLC5
  • FEMO IT SOLUTIONS LIMITED5
  • Omegatech LTD5
  • DEDIK SERVICES LIMITED3
  • Ghosty Networks LLC3
  • HostPapa3

Infrastructure traits

  • Hosting 45
  • Anycast 1

Samples

Recent associated samples

3d634e568dc4f58d4eeabd5a3771be8dbaa429fd50230ebd2561ea420b5f1b7a
Observed Aug 4, 2026Triage
c767bb6b6dd0b149e46b7066269b6d9fac1f9eb2dcafcec59475fd78a8af7861
Observed Aug 4, 2026Triage
c81bcc7c540eb1ca814514353dfb17ceed092dac0fb7de7446825287736cc166
Observed Aug 4, 2026Triage
d9d6fc3085dd822f258601164ecb21f318822a63ca0360aead9201bcee49ed04
Observed Aug 4, 2026Triage
f68ba32766e087f5a6855fa7da9feea2968280a019aec31d7d173adcd4b848ca
Observed Aug 4, 2026Triage
01be18e5bd3d04c79f8db21b72c06b84e724628e24f978a98aa86b4cb5b10499
Observed Aug 4, 2026Triage
4988bce8f555c18bed84659c87dcd00461c62537c3fd752ecc9ff3947eb9b562
Observed Aug 4, 2026Triage
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
Observed Aug 4, 2026Triage
9af478edec362f2ff147458b9581e94dacc7648f5b736975429dc0f2315b9a2d
Observed Aug 4, 2026Triage
e9554b920a4a65df1dd5809afcf5e9d0c5cd448528a03c7a232f83abcc565cd5
Observed Aug 4, 2026Triage

MITRE ATT&CK

RatonRAT in ATT&CK

22 distinct techniques

Techniques

22 techniques
T1568 Dynamic Resolution T1059.001 PowerShell T1091 Replication Through Removable Media T1204.002 Malicious File T1547.001 Registry Run Keys / Startup Folder T1657 Financial Theft T1528 Steal Application Access Token T1053.005 Scheduled Task T1090 Proxy T1486 Data Encrypted for Impact T1113 Screen Capture T1123 Audio Capture T1548.002 Bypass User Account Control T1562.001 Disable or Modify Tools T1041 Exfiltration Over C2 Channel T1056.001 Keylogging T1555.003 Credentials from Web Browsers T1115 Clipboard Data T1498 Network Denial of Service T1027.009 Embedded Payloads T1529 System Shutdown/Reboot T1071 Application Layer Protocol

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab