Overview

overview

10

Static

static

44b6bea1d0...ae8.js

windows7_x64

10

44b6bea1d0...ae8.js

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8

  • Size

    1.9MB

  • Sample

    220201-h2fkdaafcp

  • MD5

    4e713b040bd5fcf38533c4fbab817a0a

  • SHA1

    d35eb5ca2ca01f2aaac9dc4357743fdca3682738

  • SHA256

    44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8

  • SHA512

    8658b2c7b95a36512d1b26bd4e32090101519d18e2aa399d7d6a70da7ec2e17f3ad1f03787d83157eb8ffc95ffa4872241bdb387f2c8d5e7189d2ecfb59e8d04

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8

    • Size

      1.9MB

    • MD5

      4e713b040bd5fcf38533c4fbab817a0a

    • SHA1

      d35eb5ca2ca01f2aaac9dc4357743fdca3682738

    • SHA256

      44b6bea1d0693d6c08b3a9c10f06c58bafc4bc43460b4416c213844fe287bae8

    • SHA512

      8658b2c7b95a36512d1b26bd4e32090101519d18e2aa399d7d6a70da7ec2e17f3ad1f03787d83157eb8ffc95ffa4872241bdb387f2c8d5e7189d2ecfb59e8d04

    Score
    10/10
    revengeratstealertrojanpersistence

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks