Extracted

• • Target
    3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7
  • Size 217KB
  • SHA256 3f62f75c0294381629c8cb14382a5ab1d27e83966014961a414cd9411abd27a7
  • MD5 28410510706c74c2ca6494f036ebbd94
  • SHA1 4068e6a8618dc47a08962f91121c7bedf51e2407
  • SHA512 f429fcba47b03e96be57219ecf7ff1d435510600eae6772bfddc11354d357325aaa140b6db16c8c0bdbfa6a615ff72223ed332472b7c02c7a8754d342a2cf952
  • MD5 SHA1 SHA512

  Score

  10^/10

  revengeratnyancatrevengeevasionpersistencetrojan

  • Modifies WinLogon for persistence

    persistence

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Turns off Windows Defender SpyNet reporting

    evasion

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2