Extracted

• • Target

    Part Number Details.pdf.exe

  • Size

    400KB

  • MD5

    63a87210453b1e81a8edc2a0ea6608ae

  • SHA1

    261668aff6c8b06a3549a6986dc095c69df013e1

  • SHA256

    2e2cbdfac9cc07aa40c8dc0c8794f08631877dc2d0fd55762fb5e0aa598ad076

  • SHA512

    9adc718742d4fbc923c5d17bd926c60c0292bc20e8b3417ed9699e1d52b9d8500b2df65d557081dfd7d7f47e75dab2730e1cf628667cad0f7198016a7699a003

  Score

  10^/10

  evasionrevengeratnyancatrevengetrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2