Overview

overview

10

Static

static

10

b99be41239...43.exe

windows7_x64

10

b99be41239...43.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743

  • Size

    9.4MB

  • Sample

    220314-vmsmlscbbq

  • MD5

    d1b8484fc84c85b2d75e850f44d193fb

  • SHA1

    8901ee513eca44bd50115c1ef8cef90fed050e4b

  • SHA256

    b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743

  • SHA512

    9e93ea0720e9c8a84f109d1caf734d2418f40b20b341dd1809c5135741d91cb947e1bfe4095f24bc08d6d349faf0992e7a3d3ee43f36a42496a18f714a92e1d7

Score
10/10
revengeratspywarestealertrojan

Malware Config

Targets

    • Target

      b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743

    • Size

      9.4MB

    • MD5

      d1b8484fc84c85b2d75e850f44d193fb

    • SHA1

      8901ee513eca44bd50115c1ef8cef90fed050e4b

    • SHA256

      b99be412390b1eee50bca4b7f5a152c5ca7782fa9fef0107762be9c5fe01e743

    • SHA512

      9e93ea0720e9c8a84f109d1caf734d2418f40b20b341dd1809c5135741d91cb947e1bfe4095f24bc08d6d349faf0992e7a3d3ee43f36a42496a18f714a92e1d7

    Score
    10/10
    revengeratspywarestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks