Overview

overview

10

Static

static

10

b53e495500...51.exe

windows7_x64

10

b53e495500...51.exe

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b53e495500f628e4914ce71fcd5dfa5413a62220671e5fdf93377a08f057e951

  • Size

    66KB

  • Sample

    220215-15qhvsagc8

  • MD5

    a9a46a523993add1117a618d0d5d395b

  • SHA1

    5bb538557bbbe2ccc3f2dabbffe4cd25088cde6b

  • SHA256

    b53e495500f628e4914ce71fcd5dfa5413a62220671e5fdf93377a08f057e951

  • SHA512

    10b2b1d3e48c4fe089e9fd664ad49afe38ea11081bebf669854b2087a79de0147da8faaf420f26818c31a2a843d603cefe59c886706bbed5a8d0ecfc5de6b7ce

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      b53e495500f628e4914ce71fcd5dfa5413a62220671e5fdf93377a08f057e951

    • Size

      66KB

    • MD5

      a9a46a523993add1117a618d0d5d395b

    • SHA1

      5bb538557bbbe2ccc3f2dabbffe4cd25088cde6b

    • SHA256

      b53e495500f628e4914ce71fcd5dfa5413a62220671e5fdf93377a08f057e951

    • SHA512

      10b2b1d3e48c4fe089e9fd664ad49afe38ea11081bebf669854b2087a79de0147da8faaf420f26818c31a2a843d603cefe59c886706bbed5a8d0ecfc5de6b7ce

    Score
    10/10
    revengeratpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks