Extracted

• • Target

    Ff2 external.zip

  • Size

    15KB

  • MD5

    b7b23f0fb1e8d035371a4b2a7f4a6008

  • SHA1

    ff885b7b4bdbdba23e0d540f28ef4ffdf5072adb

  • SHA256

    07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380

  • SHA512

    d0cb3406b65c157095e4ddc592d39f00a43cd8c686143ce3ead7469e29f4e80756787b479ffbecaa7f016287532efcb0e33ed3b8170ffad4573421304991bcad

  • SSDEEP

    3:vhj/NVlllUtxgEEAI2tvbGllnZ5i2Qz//Z6+4Fz/RjllNVlllUll9xgEEAI7uWlp:5jb/qTIy2TU5rc15jb/q7IqWl+lMt

  Score

  10^/10

  revengeratguestdiscoverymacromacro_on_actionpersistencestealertrojanupx

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Contacts a large (1382) amount of remote hosts

    This may indicate a network scan to discover remotely running services.

    discovery

  • Downloads MZ/PE file

  • Office macro that triggers on suspicious action

    Office document macro which triggers in special circumstances - often malicious.

    macromacro_on_action

  • Drops startup file

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    Ff2 external/ff2 script.exe

  • Size

    15.0MB

  • MD5

    14b17234e237505421b6492b8d757507

  • SHA1

    48eba0e45eebde154bb49322e5098cea67717de1

  • SHA256

    167b76d3a8d20df15c421d48877c330597f6309d6b55c7b5327df5d89a51423f

  • SHA512

    8275df99cc31e7b7259799b480438186513b37f4558472b22bd2e85741845e76cc0b99f1a6030222a8ee8f1098d206cdd6c1206432214bc5f3c270f93b87e92e

  • SSDEEP

    3::

  Score

  1^/10
  behavioral3behavioral4