Extracted

• • Target

    All-in-One Checker/All-in-One Checker.exe

  • Size

    1.6MB

  • MD5

    ac75a2a8f6c389474016245df20b9534

  • SHA1

    47db5f6215d6c4817b6508db94123764fd4acc0d

  • SHA256

    e6b4c080dde0b5fa4291070e60a9fc779ef03c198ec4f99150c454a29534dccf

  • SHA512

    ee5d52d49fefbbb660e1a924861c5b88717a81889383852e047c4fbcace4b0313a8096792f02bc1fc2758160d6551a61cfb7bc0e8c341118ee6d46c059997201

  • SSDEEP

    49152:ZIxhRNN2eNLk00huhmNF7XcJ45sfgrXRSa:eRJo0Wu8NFZ5sfgrga

  Score

  10^/10

  revengeratmicrosoft .net framework servciespersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2