Overview

overview

10

Static

static

bf34977eea...9b.exe

windows7_x64

10

bf34977eea...9b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf34977eea90dc8bd7b5269b47ab2a49cdc0a63276171dffadd91936ba26bd9b

  • Size

    410KB

  • Sample

    220208-vv261sbgcq

  • MD5

    67e0931fe20e34f2afa338cedfa66748

  • SHA1

    1123279edbeca2d1eba565e57edf1ac2f19f056e

  • SHA256

    bf34977eea90dc8bd7b5269b47ab2a49cdc0a63276171dffadd91936ba26bd9b

  • SHA512

    f03396efa39bf92cb713df3fe94510b42ad2ab709efb4957d6e0ebca56d46b14c9cda063a7fb4b39bdbe1587ade5ed22b881864be5ec93dafbe103e28964f599

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      bf34977eea90dc8bd7b5269b47ab2a49cdc0a63276171dffadd91936ba26bd9b

    • Size

      410KB

    • MD5

      67e0931fe20e34f2afa338cedfa66748

    • SHA1

      1123279edbeca2d1eba565e57edf1ac2f19f056e

    • SHA256

      bf34977eea90dc8bd7b5269b47ab2a49cdc0a63276171dffadd91936ba26bd9b

    • SHA512

      f03396efa39bf92cb713df3fe94510b42ad2ab709efb4957d6e0ebca56d46b14c9cda063a7fb4b39bdbe1587ade5ed22b881864be5ec93dafbe103e28964f599

    Score
    10/10
    revengeratpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks