revengerat | 751ab6c224bfc8714a9f5704dbbf69936864907d73bb26ad62e452d17451cb74

Analysis

max time kernel
54s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
26-06-2023 05:59

Target

Revenge-RAT v0.3/Revenge-RAT v0.3/Client.exe
Size

16KB
MD5

010aabdc4dc52b82d3c6945aaefd22ec
SHA1

8f50c8e53c7da15308b57b399c22ab7b97333f5a
SHA256

0b3472c651db8cc9991a92097c22dc4cab8467aff96591f76fb89bc3af8eadaa
SHA512

609b0a617e4d6a168497b6aa8173b43690f57aefcf48eb3ce06540e7b9cde10b9e741c5d7b9eef936ab3d7857d155189902d0ab7b89784f0b61b74c10196bc0d
SSDEEP

384:X/5gk7lVzF3smf9oDPlMNcLlb5sVKhyLF5Ct:X/5gk7lVZjclMNEio

Score

10^/10

Family

revengerat

Botnet

Guest

127.0.0.1:333

Mutex

RV_MUTEX

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

RevengeRat Executable 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2568-134-0x0000000000DF0000-0x0000000000DF8000-memory.dmp	revengerat

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Client.exe

description pid process

Token: SeDebugPrivilege 2568 Client.exe

description	pid	process
Token: SeDebugPrivilege	2568	Client.exe

C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v0.3\Revenge-RAT v0.3\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Revenge-RAT v0.3\Revenge-RAT v0.3\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2568

memory/2568-133-0x0000000001590000-0x00000000015A0000-memory.dmp

Filesize
64KB

Download
memory/2568-134-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/2568-135-0x000000001C2D0000-0x000000001C79E000-memory.dmp

Filesize
4.8MB

Download
memory/2568-136-0x000000001C7A0000-0x000000001C846000-memory.dmp

Filesize
664KB

Download
memory/2568-137-0x000000001CEF0000-0x000000001CF52000-memory.dmp

Filesize
392KB

Download
memory/2568-138-0x0000000001590000-0x00000000015A0000-memory.dmp

Filesize
64KB

Download