Extracted

Extracted

Extracted

• • Target

    f198a3e52894fe22bdb0b4e42347a624157b60f501ea48816bb75911c3e38331.js

  • Size

    12KB

  • MD5

    4e37cf7563ad5ebcde8bfcb51a515c48

  • SHA1

    b9f758dd64b60da7da2f01b680d45abaf854f41e

  • SHA256

    f198a3e52894fe22bdb0b4e42347a624157b60f501ea48816bb75911c3e38331

  • SHA512

    9f63413b1759b8c467a7aa146a12f709ce5a929a928f70ea00799b6246eab3d04afea884d78a87e23ab4cb5fcb8b51269d2a5221b0bb93f9cca7c3468d2359fe

  • SSDEEP

    192:ucRB3t9iHOI42vmKrSPpOiutE+xhYB1+FXY24AoegYPZWXH:vFgG0ltJx832/7gYBy

  Score

  10^/10

  executionrevengeratnyancatrevengedefense_evasiondiscoverypersistencetrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2