HOMETHREATSRatankba
MALWARE FAMILY

Ratankba

Internal ID: win.ratankba
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

This is a backdoor that establishes persistence using the Startup folder.

It communicates to its C&C server using HTTPS and a static HTTP User-Agent

string. QUICKRIDE is capable of gathering information about the system,

downloading and loading executables, and uninstalling itself. It was leveraged

against banks in Poland.

Threat Analysis

Ratankba is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://baesystemsai.blogspot.de/2016/05/cyber-heist-attribution.html
→https://baesystemsai.blogspot.com/2017/02/lazarus-watering-hole-attacks.html
→https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf
→https://community.broadcom.com/symantecenterprise/viewdocument/attackers-target-dozens-of-global-b
→https://content.fireeye.com/apt/rpt-apt38
→https://raw.githubusercontent.com/eric-erki/APT_CyberCriminal_Campagin_Collections/master/2017/2017.05.30.Lazarus_Arisen/Group-IB_Lazarus.pdf
→https://twitter.com/PhysicalDrive0/status/828915536268492800
→https://www.bleepingcomputer.com/news/security/polish-banks-infected-with-malware-hosted-on-their-own-governments-site/
→https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf
→https://www.secureworks.com/research/threat-profiles/nickel-gladstone

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.ratankba

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Ratankba