Overview

overview

10

Static

static

d6415fde15...4a.exe

windows7_x64

10

d6415fde15...4a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d6415fde1549f0b7fae0d67319f7ff78967b2de99e6b9dc9666953e1be2c064a

  • Size

    7.4MB

  • Sample

    220314-dmzmgscdg2

  • MD5

    377a699b9cbc4b8928b16de46abf920f

  • SHA1

    f2ab02632aef4141d13c3880973bc1003d1102ef

  • SHA256

    d6415fde1549f0b7fae0d67319f7ff78967b2de99e6b9dc9666953e1be2c064a

  • SHA512

    4f916a51ec32d0c609d3c69a9b5f9c905c7c37850fdc77063db349fe4bb0ca24a9cea6180ebc59ee3754736947dafc8b54b831444b6bc585bd5a43e46bcb4ba5

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      d6415fde1549f0b7fae0d67319f7ff78967b2de99e6b9dc9666953e1be2c064a

    • Size

      7.4MB

    • MD5

      377a699b9cbc4b8928b16de46abf920f

    • SHA1

      f2ab02632aef4141d13c3880973bc1003d1102ef

    • SHA256

      d6415fde1549f0b7fae0d67319f7ff78967b2de99e6b9dc9666953e1be2c064a

    • SHA512

      4f916a51ec32d0c609d3c69a9b5f9c905c7c37850fdc77063db349fe4bb0ca24a9cea6180ebc59ee3754736947dafc8b54b831444b6bc585bd5a43e46bcb4ba5

    Score
    10/10
    revengeratpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks