Overview

overview

10

Static

static

10

02A09B72EF...40.exe

windows7_x64

10

02A09B72EF...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02A09B72EFA209C448B7C77C0A776D0FFC4647B433040.exe

  • Size

    194KB

  • Sample

    220129-mkyrvahhhk

  • MD5

    d9fe8f376ad526bafe4d4ec499434afb

  • SHA1

    465c25802ef9f08173cd4c3fd4e35660eef53144

  • SHA256

    02a09b72efa209c448b7c77c0a776d0ffc4647b433040cf812047b2aaa90c920

  • SHA512

    c169bf155145e45f08074780ab2cbebda97381330f271e02a0c7f58d223df1762fc897d34a777610ba1a3529557ca4e7a8cdc4a50d2da53f732209c92627a1c0

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      02A09B72EFA209C448B7C77C0A776D0FFC4647B433040.exe

    • Size

      194KB

    • MD5

      d9fe8f376ad526bafe4d4ec499434afb

    • SHA1

      465c25802ef9f08173cd4c3fd4e35660eef53144

    • SHA256

      02a09b72efa209c448b7c77c0a776d0ffc4647b433040cf812047b2aaa90c920

    • SHA512

      c169bf155145e45f08074780ab2cbebda97381330f271e02a0c7f58d223df1762fc897d34a777610ba1a3529557ca4e7a8cdc4a50d2da53f732209c92627a1c0

    Score
    10/10
    revengeratstealertrojanpersistence

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks