Extracted

• • Target

    0d398359c66e65c7c23e23f98732593a6a7a1eb91947249b639f3443fd65b36e

  • Size

    104KB

  • MD5

    44f3a040393c88dcb5277ee7fce82211

  • SHA1

    c2f12d9514a33a9d8debf6c3bb6fb2d80ce62ad0

  • SHA256

    0d398359c66e65c7c23e23f98732593a6a7a1eb91947249b639f3443fd65b36e

  • SHA512

    6673a96115f3d1f311efb3102d5679bd1797298e389e076dc46898c84d4d665380cf77cb3c58a6ab0b8378d2888cfc73cd49836ea278d597878a34ffbfb15da7

  Score

  10^/10

  revengeratsystempersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2