Extracted

Extracted

• • Target

    052ee61fb5185d4a7e4406ca459dc6a089fb58e605d58c0a1cd285985b4ce9e1

  • Size

    577KB

  • MD5

    1711710d30ed4194ccfde68c6b6f3b22

  • SHA1

    4f399c035bb370610940a96b3aab90eab884a925

  • SHA256

    052ee61fb5185d4a7e4406ca459dc6a089fb58e605d58c0a1cd285985b4ce9e1

  • SHA512

    fbb943b1a20a4fbe0d1d5da5b5b874cb7b728354fc24c4ab1b0d827220052d7b34117980f7a1e993814b83bc02264a8af916a0fd909cbdd065cb11b396fc9353

  Score

  10^/10

  revengeratguestevasionstealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • RevengeRat Executable

    stealer

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2