Extracted

• • Target
    a6bf7a9b696448dbc64ed4dfe0c661d6b49d48b421a8b39fa28cb8c9d0b3197a
  • Size 1.2MB
  • SHA256 a6bf7a9b696448dbc64ed4dfe0c661d6b49d48b421a8b39fa28cb8c9d0b3197a
  • MD5 9adfedfedfc7b1d46190e5877a805394
  • SHA1 34dc9f850ae29c7fc9c741c6f965b1eeda2ebdb0
  • SHA512 3f7b81d359ff78708c5b3bbc2ec3870747a81c16320a3b3bb83e68bb22e7496acd000769c932e017f242206064ca73297c89381296ca68e72af55f44564f08b0
  • MD5 SHA1 SHA512

  Score

  10^/10

  revengeratnyancatrevengeevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2