General
-
Target
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af
-
Size
559KB
-
Sample
220312-xdeqhabgcp
-
MD5
d85aaaf579761976abca4aa62613da97
-
SHA1
d0fbf145c710792b437c7cbba09af3a2ffbcacd2
-
SHA256
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af
-
SHA512
4b1368dc815fad184fd8493274abe4915a9851cdc75ebd26a495134495bda7a9edb513d0b688defe5caf0eec67867aba02c0cbffc8e0ef81114a55675aaa833b
Static task
static1
Behavioral task
behavioral1
Sample
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
revengerat
JSO ##
presentationf.sytes.net:15920
RV_MUTEX-juuVYrpxjEexV
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
max123123
Targets
-
-
Target
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af
-
Size
559KB
-
MD5
d85aaaf579761976abca4aa62613da97
-
SHA1
d0fbf145c710792b437c7cbba09af3a2ffbcacd2
-
SHA256
8123ebfcb39868d686be6910129fe6659acf3bb67e9497db491438d5617678af
-
SHA512
4b1368dc815fad184fd8493274abe4915a9851cdc75ebd26a495134495bda7a9edb513d0b688defe5caf0eec67867aba02c0cbffc8e0ef81114a55675aaa833b
Score10/10-
Nirsoft
-
RevengeRat Executable
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-