Overview

overview

10

Static

static

2932091c45...5b.exe

windows7_x64

10

2932091c45...5b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

  • Size

    501KB

  • Sample

    220319-t83h9seag7

  • MD5

    c8aa6223ca40f85c1ae6fd9024aab6ea

  • SHA1

    895469c785046dce30badb4de957f5f89657ba0b

  • SHA256

    2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

  • SHA512

    9800a04b8b408940e0c54a752fc87b41edd79d7764cbb16a0357084ee8b1dc3d3a082b424ee3f68632cbb128bde0e867854e2216ec88de48c247d5c248bed530

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

    • Size

      501KB

    • MD5

      c8aa6223ca40f85c1ae6fd9024aab6ea

    • SHA1

      895469c785046dce30badb4de957f5f89657ba0b

    • SHA256

      2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

    • SHA512

      9800a04b8b408940e0c54a752fc87b41edd79d7764cbb16a0357084ee8b1dc3d3a082b424ee3f68632cbb128bde0e867854e2216ec88de48c247d5c248bed530

    Score
    10/10
    revengeratpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks