Behavioral task
behavioral1
Sample
880-55-0x0000000000180000-0x0000000000188000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
880-55-0x0000000000180000-0x0000000000188000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
880-55-0x0000000000180000-0x0000000000188000-memory.dmp
-
Size
32KB
-
MD5
cf5442f206b6a13a388d975d78263e69
-
SHA1
521a8ad70e0fc649e1b846460e6988e5e4d09447
-
SHA256
2f5e487970cacf2050cd5b0f65e5000aef900aec92b91ee1de0742b59a4bcba8
-
SHA512
b8196f45d65a88cb050682f3827e3ee6f38a4b76d0c89a58186b5f9e5d4c040a0b5b6ded982a4eca25e3d099c522d756935949192f2db3164b27a7ddee9e3830
-
SSDEEP
384:X2/mDvD2lVzGOGXf9oDPlMNcLlb5sVKLyS5Ct:X2/mDvD2lVtgclMNEro
Malware Config
Extracted
revengerat
Signatures
-
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule sample revengerat -
Revengerat family
Files
-
880-55-0x0000000000180000-0x0000000000188000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ