revengerat | 6ea4a97b20f89400c87256d7298ff2804a29d0d9a7383e6a61009a7106010ef7

resource	yara_rule
static1/unpack001/JCleaner.exe	revengerat

resource
6ea4a97b20f89400c87256d7298ff2804a29d0d9a7383e6a61009a7106010ef7
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

6ea4a97b20f89400c87256d7298ff2804a29d0d9a7383e6a61009a7106010ef7

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 6ea4a97b20f89400c87256d7298ff2804a29d0d9a7383e6a61009a7106010ef7
MD5 5c48a1ce93bf262a25bb6ba4a8250b6a
SHA1 6797a91bb7f9f1c65dd51b7d5193ac1a99889687
SHA512 bfd1553d9d0661685b9aac1d228374df16f67781a39b3762ff5608fbc1a2d39291a97ce724f408969c8d833ee8c28c809bf45927a9ae3e0a329021359f56afe2
SSDEEP 12288:5YiMhXO6LQc1zYvLGa8IhkB7dpmyA2RiSoch3cd16Z/NPclYXNpV9Y5Hpk99sxLO:5YiMhXnGDV8NB7dFL2d16ZVampPY5HI1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

$PLUGINSDIR/modern-header.bmp

SHA256 4f5dbb1553780748df870bd872ba30e7899ebfd24731967e115ba2769cc8a99a
MD5 74df57e2a1a062ba5d7caff5807fdb44
SHA1 85b9600c0d634d50129f23edd2a416c7d2ae7a16
SHA512 c41b47583b6fa60a9e2dd5f3600da2303fe4e831956019b3a4691d1d85898ba45e35a8587d06164f8719eab2afae7db83d14d1dedd934479f4c9f6eec87fb198
SSDEEP 768:HJFU+rn+COFB8MjuZ6zrvR4esMO4f3EdpYo:H/Za0uWe5Mf
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 59899fab4ae311a6f63663e7a2bb65f345e554e0131cd053aa0c8261a521f76f
MD5 dab1c66c9461c3949113d41e24e783ed
SHA1 173246fdb762b8d2be94164692e842837991f36f
SHA512 ac932fac3043032b87013e54b3cb766a1a6d92975a73ae3889d6d855776ca0ee6405d2ebcafc13e4bf8fdbffa982b311fdbe7425936bb1d2b48f03f8bb67504b
SSDEEP 3072:v7lBB/oyBjDgottUWqENqUJ1rVbEQUHtNq4kQPH9AiNDmX99NJNCNcD4NorKPNTe:TBlBjDVjUWq8qU2vtNGJSE
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/welcome.bmp

SHA256 59899fab4ae311a6f63663e7a2bb65f345e554e0131cd053aa0c8261a521f76f
MD5 dab1c66c9461c3949113d41e24e783ed
SHA1 173246fdb762b8d2be94164692e842837991f36f
SHA512 ac932fac3043032b87013e54b3cb766a1a6d92975a73ae3889d6d855776ca0ee6405d2ebcafc13e4bf8fdbffa982b311fdbe7425936bb1d2b48f03f8bb67504b
SSDEEP 3072:v7lBB/oyBjDgottUWqENqUJ1rVbEQUHtNq4kQPH9AiNDmX99NJNCNcD4NorKPNTe:TBlBjDVjUWq8qU2vtNGJSE
MD5 SHA1 SHA512 SSDEEP

Data/App.db

SHA256 af2e5b8e15332d4f6a530df4da3c06a1da47c766a5b9d5a4909b194320f43905
MD5 9c534a93fdbc6c6e5a740cd2f4e29fc6
SHA1 15e25c07db06583475875f31d22b8d66bea8283b
SHA512 09ad27659ed1ca13a09174d2dc60932c7b0fc641cc3ed96d4ec8552f17ed6a8c5057d902d55072695eec80cc34ba83befd31ac097c37b896722446de841b744e
SSDEEP 1536:esbvcGiCn239xThwztUnP9zHwDkJ6cM1tpBgjJWTXisqGb7aRDE8DZ5OdguRZe:eccHCn239CtUFrwDkJ6RRAQaRDtDZIJW
MD5 SHA1 SHA512 SSDEEP

Data/Language/Arabic.lng

SHA256 d73d656b0dab6e99c999dae832ced1c1ba805fd203671bdf84089f8dbadb13f4
MD5 bb681cb152017ebcb6dfc3cd9089ade7
SHA1 3e993eb935a36a8a455184d62b978191c56f7d83
SHA512 cad37694af9a500a1900261fa614bce428d0464190f48b30c5d4e61259602a1bb16052dc93cae422a989ccc68dd4fc532f1ea31bbbfbade83b032514f6edaf13
SSDEEP 768:b6bIQCX73w/VUzkifYQZAKezNPq/7OaZb:bqtg3sVSkifTZAKezw/7Osb
MD5 SHA1 SHA512 SSDEEP

Data/Language/Armenian.lng

SHA256 7cf55e16ca4cf7293b788be2aa155fe878ab38440130ac2d531548edf1c974c4
MD5 a9a9f233102c7b3bb268096db9051350
SHA1 9b2768c64146217fb1248417189a5b2e18dfee34
SHA512 f0f06d20400e67541fcfa4669273c2d7012a47fe55685114dfb6bcbfab93b28004dbfd5183fa13b8b0f9a543ee95b0d37892daa8a7df9e1ac9212d69bb3309bc
SSDEEP 768:Ly6pboZgEhGZ5rfeOxrksq3NjoXO2nKy48OisGrS:LyK8ZZhUlMoXO2nKxist
MD5 SHA1 SHA512 SSDEEP

Data/Language/Chinese.lng

SHA256 b35bb5e314342642ff11afb697771d7ba5651f3f7403dae62975573dbe9de45d
MD5 925bb179961604bab585225d3a637d82
SHA1 7cfe834801348e9a83035d6c04f34ceb7d4122e1
SHA512 c24db35a3443af16f3e7a3f37612820c0c7c4981d1d0290ea26d24262c20e1f6d8390f8325560ca8393dd2545aed3fdc6d4d1ad047311ec60cce60f02340c55a
SSDEEP 384:zf/v/07XYXP8mk12MJen+rfBMtfoGd8IVZvV3VM70eBz3deLRDiswCS:Tv/0LIP8mK2MQDtdxVb3teGLhiswCS
MD5 SHA1 SHA512 SSDEEP

Data/Language/Czech.lng

SHA256 f793b84072a2b985dfb55e3d994cb1fed8a07e995f65a7c38477c7a51fa6bbf0
MD5 784e2ea25146be7f7067ee4cdb97dff6
SHA1 c5471e050b752485e07d5558cba36ffaab87ab69
SHA512 ad93d2fc6da4968bfde90199bcfa30a044a59aecbec8b14fdeca8ddc3babd726d9b8fc29d6d9883c2b5c0fbe2189425dfc92d4b2be1a0d10cb1dfd63832288d8
SSDEEP 768:j3oyN4zAR01tPLmzUkiKXfeO0zsUa3F7oXO2nKi48OisG68S:j3Pi0iKMMoXO2nKBisP
MD5 SHA1 SHA512 SSDEEP

Data/Language/Dutch.lng

SHA256 c5d0017ebee17b48eafeaad652192c883bf4c59f60a5e3f05744056449aaff70
MD5 d8ea5f7d3b6d1ee8a41efcf86d1ea03b
SHA1 d82cc63a05289bfc843bea2726d7a7b47cbab85a
SHA512 394d01001ac3e1dc17149c2945223ee82409ffc0609de03fcb25e6e862f3c8a9336628b4d2ef63fc2de1749cb9df8f2bfea3355efcebda5ccc820fce4cdd4815
SSDEEP 384:vSIhnl/TLURLMzLq9kylnaFJbVtfacz7NL5qY83Nv:jx0KrylaTnfa+L5o5
MD5 SHA1 SHA512 SSDEEP

Data/Language/French.lng

SHA256 cdcbf1e7aedb7b247a0469808400e8d6bd2dd708e813b56b9713f8cfec6eeff1
MD5 3c18ca003a75b536eed5c454554b6ca4
SHA1 62d1877fd630a914fb534f1396d3305884a03eb2
SHA512 e2a9723aad4c9a900845bfad6f3573a0cc5d966b4dedecd14275101d9bf6377ab2643de7b51c717acd77040ec51717535c0f39354556b2481f14d2df23913d66
SSDEEP 384:1fapi6+6kApoSd8md0DLcCfLCpsjD44N77mrk2nTS:9S+6/NdJqggC+DtNGpTS
MD5 SHA1 SHA512 SSDEEP

Data/Language/German.lng

SHA256 3e5199633ce3f4268bde296e7ec4bd98d60dec50ee2d5fce9ae9b4d228d62ce6
MD5 79e1cef984f9581003c302c7335bcab5
SHA1 b4cf9b754e6edd6a231b4e2ec2c3daa91474b087
SHA512 6fd0f0c29c3c114a89145e3a0351da763596405220027e5b1b48e32b2fe4bd2ccf22c14f0e28bb26095e18d748e1b6b72411e8c28b87853989b011da0ed65ebe
SSDEEP 768:z93gKAaMJUhaau9a+sKZ5j/lOkILlsECyndcjwIqHw7:z93gKAaMJUhPP5Y555ElsECyO5
MD5 SHA1 SHA512 SSDEEP

Data/Language/Hebrew.lng

SHA256 974f3ae5024fe059e7d646eb00a9a4c86c3ea96842854a26a110a18161289034
MD5 86911827c8541d94530abafa16ae44ef
SHA1 6c4bc531c8a8336210afbdbfe29aa000841c4164
SHA512 0895706f60bf42e0e37dc5d10734d93827a529d0092a517d92be71aab93cee350f1926d9b0e9dcad207741cb33da1e202c8bde866188d460218b678bb1fe1c49
SSDEEP 384:Ly2zhcahIqM+EvHR8uK4FCmHQFJF+cE+P57GeBngnGVfRB4O:LyU58LwmG0ebG5O
MD5 SHA1 SHA512 SSDEEP

Data/Language/Italian.lng

SHA256 a58e324e7dc8f20390bf8bcf461c824be4bdc01f7cd69048cf85a2a529c92b39
MD5 60bc17b8f57de61e12a3cd3ae96182f3
SHA1 6d8c38b21f982a4bd14a16c7b6a550b6b1eb7810
SHA512 eb369b50a97bcc47b87df3c9cac0eb3b29b0002313b372c53bc01effe2915fd14cd2eb3d224b41a63423287d6f2ba50556fdb2062129130ac7afde9d4049bbc5
SSDEEP 768:oOAy3tlH9YKZRLBPTDL7MQqcgEMI8Iby36lQuCJ1B:oOAytldnLPTv7D8D6lM1
MD5 SHA1 SHA512 SSDEEP

Data/Language/Polish.lng

SHA256 ac033c7235f21f30c2dac20ad4f15c7da27e975eec17a4434e3631dd66dea86b
MD5 5c245dc227307457c52016fe5b40ba33
SHA1 8fd7bd0740628523a18e075a72c5f2239a66b339
SHA512 37c3602383d4b1c8a4f3827144b2d49c4a426dade63f29847b5060e9b17f3e28ff3efdb653750280663ea899884fbbcae82856b9a7c77730603f4b7a9e5a49ec
SSDEEP 768:zYmElbejtinKeJIpTwyMfXdpTRccDwm0Ma28:vObzVbou8
MD5 SHA1 SHA512 SSDEEP

Data/Language/Russian.lng

SHA256 649d0ba2e666689f484593f544aed400607f79fefebc0aadbeb2ce76956c4d88
MD5 745430320c600dfdc61d4eb99f60534a
SHA1 5d45cc4d135177bf8e0202a86725f805658841ea
SHA512 fb7230c8e9b8ff95800e8f4fbeb3088c3526cab81b747f14d8fbf2e60de1931c715cb0150525b974c691118bf212d1a881e0f06100eaec7041ec045f5db89da2
SSDEEP 768:gOTDhoGxLJGlZjdZMLMSzl8iYcFCIFJl8snO3kfRTDtgXFrYuq/N3Oh6/ly25Obm:gOTDhoGxLJGlZMLMSzaiYcFCIFJl8snj
MD5 SHA1 SHA512 SSDEEP

Data/Language/Slovak.lng

SHA256 14fa118fca8d6f90331c0bbffead35be41a60ef882c358a13d87e4a23282f678
MD5 ad7ffbc7f93e7d39c32b8ba02c2593fa
SHA1 d1111d29af2172413cf95db1c314b1f292cdc9d2
SHA512 22fc3b067554788ddcae5facacb0a1d36a305e89d1e64ffa02afd424020aeaee798da1b8a709ea9f3d1e048e6afc86add1dcb24d94c45e2e78c0426bd4bcc8a3
SSDEEP 768:uVG2vxTvBFdBfaE2d9WUvysUa3c7oXO2nKr48OisrOS:uVHxT3dBfQHW0K9oXO2nKuisX
MD5 SHA1 SHA512 SSDEEP

Data/Language/Spanish.lng

SHA256 8511c2b35795bb6c8398f0c1e2fba67ae92db43ac35ac85c83575fc1de625a1e
MD5 d0d04fdc05f69571c612e1c34b5e9407
SHA1 c9b47ef1edf236a8419ca0adfd0caaec504fba83
SHA512 235600604c3c5746bcfb9ce23192c5eb525a2ebe3c29b4ef69f2075b90a9240bb57d610ebd53e3517db5530b15a4f4bdb72d5aa46ac5574e24a820ab6bb5cb45
SSDEEP 384:PDn4WkzLY38U52zcurq+w3esT9vyr4mLDQ+sSROc0kvX+wuWHm28oJaOtdvihRXm:ugq4mXnRO3UX+wuWG27btdvihRX2h
MD5 SHA1 SHA512 SSDEEP

Data/Language/Ukrainian.lng

SHA256 b6b46b3e60a051b01ace553085e47e253b58daf865572d3ea58dc290240b9cd5
MD5 65528a9c81c3e1d81b889b383b60600a
SHA1 d0aa5c2342dc7ed4bc6426ebc8728e24e9946cc3
SHA512 2722dfdf8f7f405890f5fa8bbc03f89ed4000a8f74c2d74c72fd74acfd467f36866ff13c6acc0f3b5e1db4391c9e30e08373229ca8fe0c97b610588ae8769945
SSDEEP 768:QRG7lTFuzbfgO+CFPtFDfDHKGgfY9fFzG0v+0ruKeD8QUAscGhT0QQ4ZkYi6IcKv:QRG7lTFuzbfgO+CFPtFDfDHKdY9fFzGX
MD5 SHA1 SHA512 SSDEEP

JCleaner.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8a1e45ec8a5b3c0bd3113ef6ce28a6835584b3fd00e3c2dfd43fb2e97747722f
MD5 19f92c663d5e9b226309aa87e28261d2
SHA1 64cea83eb6ee0643ed6f3336b232a6ce9a47eaa5
SHA512 0fef84f11855566cf143deea4162b79e8dad005701797cf1cc09ff3306ecd5e066937cf4feedad7c7450a3f1392cd9ffdd3836579e38e8a8d7f28c37aad44e19
SSDEEP 24576:TME34JHXxFD2RAh3DK230OSRBF8EdCmD4HzGb2G:dQHhMAVDK23/YzdCY4Sn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

RevengeRat Executable

stealer

Digest

8c:d1:12:3f:c7:6f:9a:e5:62:40:59:a5:5f:52:98:8e:da:b1:a0:42:ca:56:d8:5a:86:2c:af:d8:ff:a3:b2:e8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

Chains

May 31, 2022

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

Serial Number

3f:a2:17:4d:90:56:2a:ef:ea:f0:22:e8:1a:81:f5:31

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2021 - Apr 1, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #3,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

90:39:7f:9a:d2:4a:3a:13:f2:bd:91:5f:08:38:a9:43

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 11, 2022 - Aug 10, 2033

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

1274342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\New Vitsoft Utilates 2010\General function\MyRegistryNetModule\WindowsApplication1\WindowsApplication1\obj\Release\JCleaner.pdb

JCleaner.exe.config

SHA256 5b5185fb03ea03c56d81b9f514cc0451dfa90175fc5507fbeeb233e735a72ab6
MD5 804aa535f1853c05617e0e09fea1ef1c
SHA1 e8f64b1074a750ec71967f7f434b48edeb3813e1
SHA512 9e0b94001c031f29a2c67d59e603e7a6e22231483239db567c711369400ebe6cc6b9fe46e691a3d964d52c690b57f5d519e43201a22f7bf83c9783dabf709686
MD5 SHA1 SHA512

License.txt

SHA256 92498a245e0993792d9d6edd854d8082792983c76afb56e4562ca6e4feceb0f1
MD5 8444a9629fd51b5e1bba5178cc8c947c
SHA1 9d274583c05207db7c8867ab3b8a46857c0b4656
SHA512 715759dfc925cf045151f58809c680d0a857450d05c769df22b3c781f8cf7c102b136288e24ee361b759b8db4c217a8c4793ebf437a31858a3c24ef01e94ce16
MD5 SHA1 SHA512

Schedule.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 bbab8ac10079facf49878a389a3462757f031499c5b954d386c641e42733a937
MD5 728a2c9b29e3e741a8877e8dd87bd448
SHA1 3bf3b8c9a9e5b5acc40a544a2545509e7943f97a
SHA512 2c9be16a1d60a8cdfeeb8baf74479478649e3d28ad537f005a874b3f36450ff91fe16148c25228e440379ab7683519c4abc22ada35cde3ef9b787f7d5e872f13
SSDEEP 1536:Hu5nmlloRM/T7t/Gzp4+PFpK1l7t/Gzq4+PFTKiEvNzTYwNQ+8iAi:Hu5uloRMLlEppW1llEqpAiEvNnkDi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

fd:14:07:a0:d1:7c:aa:7f:66:74:36:0c:5f:98:84:fd:ad:c1:a0:12:57:aa:f7:5d:34:47:9a:58:95:f1:b8:e7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

Chains

Jan 31, 2022

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Vitalii Mikhalko,O=Vitalii Mikhalko,L=Novohrad-Volyns'kyi,C=UA

Serial Number

3f:a2:17:4d:90:56:2a:ef:ea:f0:22:e8:1a:81:f5:31

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2021 - Apr 1, 2023

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 12, 2019 - Dec 31, 2028

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 23, 2020 - Jan 22, 2032

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

72006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\New Vitsoft Utilates 2010\Schedule JOYOBOX\Schedule Joyobox Cleaner\Schedule Joyobox Cleaner\obj\Release\Schedule.pdb

Schedule.exe.config

SHA256 5b5185fb03ea03c56d81b9f514cc0451dfa90175fc5507fbeeb233e735a72ab6
MD5 804aa535f1853c05617e0e09fea1ef1c
SHA1 e8f64b1074a750ec71967f7f434b48edeb3813e1
SHA512 9e0b94001c031f29a2c67d59e603e7a6e22231483239db567c711369400ebe6cc6b9fe46e691a3d964d52c690b57f5d519e43201a22f7bf83c9783dabf709686
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer

6ea4a97b20f89400c87256d7298ff2804a29d0d9a7383e6a61009a7106010ef7

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/welcome.bmp

Data/App.db

Data/Language/Arabic.lng

Data/Language/Armenian.lng

Data/Language/Chinese.lng

Data/Language/Czech.lng

Data/Language/Dutch.lng

Data/Language/French.lng

Data/Language/German.lng

Data/Language/Hebrew.lng

Data/Language/Italian.lng

Data/Language/Polish.lng

Data/Language/Russian.lng

Data/Language/Slovak.lng

Data/Language/Spanish.lng

Data/Language/Ukrainian.lng

JCleaner.exe

mscoree

dotnet

JCleaner.exe.config

License.txt

Schedule.exe

mscoree

dotnet

Schedule.exe.config