Overview

overview

7

Static

static

4

RevoUninst...lp.pdf

windows7-x64

1

RevoUninst...lp.pdf

windows10-2004-x64

1

RevoUninst...rt.exe

windows7-x64

4

RevoUninst...rt.exe

windows10-2004-x64

1

RevoUninst...sh.ini

windows7-x64

1

RevoUninst...sh.ini

windows10-2004-x64

1

RevoUninst...Un.exe

windows7-x64

6

RevoUninst...Un.exe

windows10-2004-x64

6

RevoUninst...Un.exe

windows7-x64

6

RevoUninst...Un.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RevoUninstaller_Portable.zip

  • Size

    8.6MB

  • Sample

    240425-rbgt7abe23

  • MD5

    5178aeba4f6df6d3286db3279ea5ea42

  • SHA1

    2ae1e2b7715ee5558cac80118a8bef638348055d

  • SHA256

    fd8b2fb37d0f146fef98dd7b6079fe40a4e04879e247f4a37ef12443ccf6c2b3

  • SHA512

    63350664b19b88d099c160190887f8c0054fd79036cb3b6338e31126c7857c1c3ed6228c679e82497c446b36c95e760e09cb823c32824c1973cf2a6e4b2db34c

  • SSDEEP

    196608:+CIWZpaF8TmKnviC6c8OVET4H8odWAPmBzaUZuTE4j6p+:BprnviCVLV24HBd+Bzyj6p+

Score
7/10
discoverylinkpdfpersistence

Malware Config

Targets

    • Target

      RevoUninstaller_Portable/Revo Uninstaller Help.pdf

    • Size

      1.4MB

    • MD5

      7c770b8371e21ba771f108549941b063

    • SHA1

      44e44e7a8100c0540572cf8314dd1f39211f1134

    • SHA256

      47b002d89da453eb352b176d63e08960ea3e3aa3d7069c8a5e8872621568ac87

    • SHA512

      96691912f5f7dc1eb7e851e8ea6fcdac82d6c92740a2accf0f1a01a4f9f617140fe7e77704e41e918286564606e6065307fdbdf2a6f1ad384b1cfc7cfd4c5b81

    • SSDEEP

      24576:60eF1JSdt+cVqoIQC7ZiBI2cj2MWY8kayZpN5h4Ia4pSyNVzCc8pt:YF1JSd7C712JHinZ75G/DGdWt

    Score
    1/10
    behavioral1behavioral2

    • Target

      RevoUninstaller_Portable/RevoUPort.exe

    • Size

      200KB

    • MD5

      2f814a927d097a09911111dbf0fc2e93

    • SHA1

      8e4e953c60653a333182320345209765695d4e17

    • SHA256

      ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf

    • SHA512

      d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619

    • SSDEEP

      3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh

    Score
    4/10
    behavioral3behavioral4

    • Target

      RevoUninstaller_Portable/lang/english.ini

    • Size

      102KB

    • MD5

      5f57e969cb8f3ad0bbd859207a283bd5

    • SHA1

      5a232b0eed2d7437513010c7a0af05cc4de3d90f

    • SHA256

      f2e8f9e5cf4f057e3399ff66485a485cba419881aeeac997049941396bdf63d8

    • SHA512

      c48ec65d7dc7f1ef77bc708cdb6f49106651fb6d715450168f4d5fa8105c24dfb43d7378d8b0ceba567942fd73fc95f7d41fd75c0824e619609981710b504cd0

    • SSDEEP

      768:Qo3oi7/ETiuWD6V5yBxzqp+iImPXhF9cie9MzJs5IzSRGYeop6w/lB69YK3zgiv0:KO6ryBxzqp+iImcV8op1lB69YK3zS

    Score
    1/10
    behavioral5behavioral6

    • Target

      RevoUninstaller_Portable/x64/RevoUn.exe

    • Size

      14.4MB

    • MD5

      dcf9c35c8dcfb6e4d90bfe97ac1a2b92

    • SHA1

      1b15760c97b292dcc891fcb0624819dfa7a66135

    • SHA256

      affb9421aa7bc562616fe0793cdb454925640ccff027ca8350e6a06b3f24c4b9

    • SHA512

      cfe55a92ca297dae4269a7b8a30148df871f244c67b52dbac085b12966121846cd306992585926fec56b6e7a150b5478611e53e40e5841d327a8ca2312be5846

    • SSDEEP

      196608:bB1bn4g/F2S4afjAzM39fOrwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIa:bf0g/F2S4afjr9fOUPWpGplR8ZWS

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral7behavioral8

    • Target

      RevoUninstaller_Portable/x86/RevoUn.exe

    • Size

      12.2MB

    • MD5

      15657f176a5eea4c0f943da107962d24

    • SHA1

      2e4d2eaa1144ee1dd7d34fa580866a199e0012c7

    • SHA256

      c6762c436785680d7a363821fa7d5767ec71fea45473501dee8c47007bf2b2c4

    • SHA512

      880dbf849d041a96a61de84611c040bf674899bc0ecab693afe2cf911aa37cb537b83ecfd11525fce0d4758bdabe68092d17c6b5e2f4cde3fd58dc96f14bbf15

    • SSDEEP

      196608:EH14G7PwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIA8Zk:FPWpGplR8ZWk

    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral10behavioral9

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

5
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks