General
-
Target
PI098788765.js
-
Size
229KB
-
Sample
220612-3l4x9abgcr
-
MD5
a94120f574ef044bd35a4e167d6e5a05
-
SHA1
ec73c38470585db035b6a6716495afaaa83ff577
-
SHA256
9081b8dc4bac6ddfe0a3c54ef32cb810be6b012a2d82ca70c3a4b9466b436086
-
SHA512
5e737de130ac934ddc0ca6a3cc345a3e4da9f1c61f244ad79bab182da2e5173ae7633bbda78d3a375755140100b768c82e6e82b36ee27469e0252f4424ee7bdb
Static task
static1
Behavioral task
behavioral1
Sample
PI098788765.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PI098788765.js
Resource
win10v2004-20220414-en
Malware Config
Extracted
revengerat
Guest
blessed147.ddns.net:8089
RV_MUTEX
Targets
-
-
Target
PI098788765.js
-
Size
229KB
-
MD5
a94120f574ef044bd35a4e167d6e5a05
-
SHA1
ec73c38470585db035b6a6716495afaaa83ff577
-
SHA256
9081b8dc4bac6ddfe0a3c54ef32cb810be6b012a2d82ca70c3a4b9466b436086
-
SHA512
5e737de130ac934ddc0ca6a3cc345a3e4da9f1c61f244ad79bab182da2e5173ae7633bbda78d3a375755140100b768c82e6e82b36ee27469e0252f4424ee7bdb
Score10/10-
RevengeRat Executable
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-