Extracted

• • Target

    9c3c91edfaefea76fb34eddc89c356e32e0adf3d64ea020f61741020293d9b5b

  • Size

    23KB

  • MD5

    0e59414b319810c1c0a50a65461ee1f7

  • SHA1

    3f3912c6427ae1a084c59582e7150bbf7006fd8f

  • SHA256

    9c3c91edfaefea76fb34eddc89c356e32e0adf3d64ea020f61741020293d9b5b

  • SHA512

    c04e0c28ba20cdeaabd9438faae4ffbc5d219f9f5e2c43fd29fc3a2319f52df111c30b02272766ee67ff7fda9844f0de97b5ef76c1a919c763dfaad18ee4ce3c

  Score

  10^/10

  revengeratguestpersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Drops startup file

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2