Extracted

• • Target

    061f6722784aedb82b0c2ab822c0e08ceaa88bf10eb8aed80bbd4ebd056de9bc

  • Size

    170KB

  • MD5

    6bdd0461ce6cf27ac8ee5615e0da1c70

  • SHA1

    517560e5361084641380f349e005d6e3ce5c3a26

  • SHA256

    061f6722784aedb82b0c2ab822c0e08ceaa88bf10eb8aed80bbd4ebd056de9bc

  • SHA512

    bacb364508f71dcbffca34c9481b528e9394fb1d939bc81a810dcacff87d6e9ff8eca8c683dfbc23ee2f76795bb3fda4d5e8089ab3e2d8304f123570fd1f0c84

  Score

  10^/10

  revengeratnyancatrevengeevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2