Extracted

• • Target

    6ba80c4c0298efdf3e6a1cc0813f5e471cd41b33940a64b7507ddf715912401e

  • Size

    108KB

  • MD5

    2f70e8a5b8655e094a4fb445b5ba8c42

  • SHA1

    9137dc636262db62e8990f58b0bc64a28f73e6af

  • SHA256

    6ba80c4c0298efdf3e6a1cc0813f5e471cd41b33940a64b7507ddf715912401e

  • SHA512

    3d355e315fe6ef148041284b1f2631a3703bc6019650721c1cea85898289725ef2cd772b80a6c5d671831ef083182cec0c3780313587d28d0fdbf3db0ef2eebe

  Score

  10^/10

  revengeratguestpersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Sets service image path in registry

    persistence

  • Drops startup file

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2