Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

4

RevoUninst...nt.txt

windows10-2004-x64

4

RevoUninst...lp.pdf

windows10-2004-x64

3

RevoUninst...rt.exe

windows10-2004-x64

3

RevoUninst...rs.dat

windows10-2004-x64

3

RevoUninst...ch.ini

windows10-2004-x64

1

RevoUninst...sh.ini

windows10-2004-x64

1

RevoUninst...gs.ini

windows10-2004-x64

1

RevoUninst...rt.dat

windows10-2004-x64

3

RevoUninst...Un.exe

windows10-2004-x64

6

RevoUninst...on.bmp

windows10-2004-x64

7

RevoUninst...Un.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RevoUninstaller_Portable.rar

  • Size

    7.5MB

  • Sample

    240806-qltfasthka

  • MD5

    76394beb9925aadbe26543f89e2253f6

  • SHA1

    9bf1f01fd181654a6d56e050f466ee34f4039530

  • SHA256

    3b4fc2a2e594506881d82a8c418e9bcf572b3269dfab952f5ef70ea6a8838884

  • SHA512

    55728edafbaab444851e8abaa0623a16527a25677039749af9aafa1311badd6359d64668e6b51f8f1a1ab7ec3f0ae4672b7e187f0fd09c9b67eb05b0b0feee0e

  • SSDEEP

    196608:F1bDjBNtK8AmO91Kqx0XmAEJzaSI9i9GyfCUtlanROjwH0h4:FhjBbKXOJERPI0syKUtjjwUq

Score
7/10
discoverylinkpdf

Malware Config

Targets

    • Target

      RevoUninstaller_Portable/LicenseAgreement.txt

    • Size

      6KB

    • MD5

      13d3876c402174dcd9239c60f559fa7d

    • SHA1

      1cdda259609df4c18ff13aa2f7a4e475e1ef1945

    • SHA256

      079a40fdcab2f7bedf66cd9ab26fce42d2057ef899eba7fb367d9f6981b30267

    • SHA512

      8e8e04401c5a4637d110d4ad718321f027cb39f1a366e021584f657dbe30c01384f60a82ddaf6ff2e4291f8354d026723515b0029059f064a17ca7d44d0fae6f

    • SSDEEP

      96:oxfbLEJB34LGPy2ZJ4bTw7aw4ri2q9uCosEt+i4B7KVrVHBhyo/fKhwsi:onLs3fLbnEtj+7gZH3Z/Ch2

    Score
    4/10
    discovery
    behavioral1

    • Target

      RevoUninstaller_Portable/Revo Uninstaller Help.pdf

    • Size

      1.4MB

    • MD5

      7c770b8371e21ba771f108549941b063

    • SHA1

      44e44e7a8100c0540572cf8314dd1f39211f1134

    • SHA256

      47b002d89da453eb352b176d63e08960ea3e3aa3d7069c8a5e8872621568ac87

    • SHA512

      96691912f5f7dc1eb7e851e8ea6fcdac82d6c92740a2accf0f1a01a4f9f617140fe7e77704e41e918286564606e6065307fdbdf2a6f1ad384b1cfc7cfd4c5b81

    • SSDEEP

      24576:60eF1JSdt+cVqoIQC7ZiBI2cj2MWY8kayZpN5h4Ia4pSyNVzCc8pt:YF1JSd7C712JHinZ75G/DGdWt

    Score
    3/10
    discovery
    behavioral2

    • Target

      RevoUninstaller_Portable/RevoUPort.exe

    • Size

      200KB

    • MD5

      2f814a927d097a09911111dbf0fc2e93

    • SHA1

      8e4e953c60653a333182320345209765695d4e17

    • SHA256

      ef70640d701bf406f7008c9ef7dc594019c063e4436415c97033f0a998697edf

    • SHA512

      d57fa5fdd2ce0ed148e43814420103e0e340862d6a9c35714ede6fa059dad0b63963b790824cbc126535b97c23f2fd560eb0891050fc0f3996a30c7ee8e99619

    • SSDEEP

      3072:0kLnAdeRbvAZpoKIIn9xg//XHTfq2M0W30L/OHQ4HFs3qMGrfv8Th:3LAoYZCIn9SzsFwWqh

    Score
    3/10
    discovery
    behavioral3

    • Target

      RevoUninstaller_Portable/ctrlbars.dat

    • Size

      818B

    • MD5

      cf9864cc799f30f71ceb698323a106ed

    • SHA1

      0e9c3c1403a752b7e4f5577071115974dddb04c0

    • SHA256

      ee789b146e7fa45700690847088b75e9e853f55661ce38ab1454e333f0d24864

    • SHA512

      3c5d35cdd4c9bb9799bb731f37b6102a369ee0fc66c2697a0d20681c08ae9a7643cbf4ebcb52af2c77b3374b0fda8c41a9fccd08366b585fc6ba77610f16d7a4

    Score
    3/10
    behavioral4

    • Target

      RevoUninstaller_Portable/lang/czech.ini

    • Size

      98KB

    • MD5

      edf65aa9e3901e57e6290c53d9b18f19

    • SHA1

      c22a962518f577f96d187831c4009d807f5f8b6d

    • SHA256

      aa6b1d30a2adc755a44122aca13c7ca56c740c6e69f9b799ea6fd5ca7109dc4e

    • SHA512

      0be4b66e464ccc6108df33156eef18e473424e8ebe832060321dea50be93e2a8e1aa81801ab44d545e24654cb112abf302d983345936dc2e8a73b0abbd4a9505

    • SSDEEP

      768:Qo4WsLv7IW5d2Up6zgnwnDLJ7u32oKmbcEUE6KkAcsl5V9nOlIjVM2bhTRvwLaJO:Wv7YC5V5xjVM2bhtvwicvgU/WdEc0Km

    Score
    1/10
    behavioral5

    • Target

      RevoUninstaller_Portable/lang/english.ini

    • Size

      102KB

    • MD5

      5f57e969cb8f3ad0bbd859207a283bd5

    • SHA1

      5a232b0eed2d7437513010c7a0af05cc4de3d90f

    • SHA256

      f2e8f9e5cf4f057e3399ff66485a485cba419881aeeac997049941396bdf63d8

    • SHA512

      c48ec65d7dc7f1ef77bc708cdb6f49106651fb6d715450168f4d5fa8105c24dfb43d7378d8b0ceba567942fd73fc95f7d41fd75c0824e619609981710b504cd0

    • SSDEEP

      768:Qo3oi7/ETiuWD6V5yBxzqp+iImPXhF9cie9MzJs5IzSRGYeop6w/lB69YK3zgiv0:KO6ryBxzqp+iImcV8op1lB69YK3zS

    Score
    1/10
    behavioral6

    • Target

      RevoUninstaller_Portable/settings.ini

    • Size

      3KB

    • MD5

      6e91f903b20f238a02ccab1c48bbde8a

    • SHA1

      daba4ea11ec00cbdaf75d7581e4ceaaad8f64f66

    • SHA256

      6c18f70fed798278806a3fe562d93d53ea347548c001fcda481f6f045f5e8573

    • SHA512

      0949b1f5bb1cab5530d71c021d622d897fd50e7850ed5f76c20012af41580088506f8033380e89afe74c88fb14179b408e5bbafbfe69719827110170f6b870f9

    Score
    1/10
    behavioral7

    • Target

      RevoUninstaller_Portable/un_report.dat

    • Size

      1KB

    • MD5

      9734b4563269f162906fe1ddfaff4a0f

    • SHA1

      9d525152dbfc47a180e885de95d6e8880c5ae652

    • SHA256

      8fc9ac2c923ff473675e757d09c41c8e1b15fba3696574c2df8de489f491bbf0

    • SHA512

      1c91161c3c900f78a6a468d4aefa065225ae3712fef225ddec32532ccb6b1a04d1273d0732a742bd75dac282496f4dd8d2aa3bc2da34b987524cfd18576d7abd

    Score
    3/10
    behavioral8

    • Target

      RevoUninstaller_Portable/x64/RevoUn.exe

    • Size

      14.4MB

    • MD5

      dcf9c35c8dcfb6e4d90bfe97ac1a2b92

    • SHA1

      1b15760c97b292dcc891fcb0624819dfa7a66135

    • SHA256

      affb9421aa7bc562616fe0793cdb454925640ccff027ca8350e6a06b3f24c4b9

    • SHA512

      cfe55a92ca297dae4269a7b8a30148df871f244c67b52dbac085b12966121846cd306992585926fec56b6e7a150b5478611e53e40e5841d327a8ca2312be5846

    • SSDEEP

      196608:bB1bn4g/F2S4afjAzM39fOrwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIa:bf0g/F2S4afjr9fOUPWpGplR8ZWS

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral9

    • Target

      RevoUninstaller_Portable/x64/button.bmp

    • Size

      4KB

    • MD5

      adc319b9cde52444a7486ba50294d34c

    • SHA1

      7a7c4fa9896e6f3d12d8464ad8a98d75c51c1f78

    • SHA256

      18d6342804edc786e5f3c5c6249e68681594809492880c4bcca7c5c490ea4e51

    • SHA512

      785cfe2a03c6f292f012ee0435f436dab814cbf4282fdcd5a31c3df716124ee6c605e7a13b3f7723356db01baa52dcb844dc8e8486189a7fe8fc6522b87f8d5f

    • SSDEEP

      48:yJxwyvOO5Vs9RnMLK2UNsShRYmOB3gVKD4nLyjF:WvOlMK2esShRYmk8GjF

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10

    • Target

      RevoUninstaller_Portable/x86/RevoUn.exe

    • Size

      12.2MB

    • MD5

      15657f176a5eea4c0f943da107962d24

    • SHA1

      2e4d2eaa1144ee1dd7d34fa580866a199e0012c7

    • SHA256

      c6762c436785680d7a363821fa7d5767ec71fea45473501dee8c47007bf2b2c4

    • SHA512

      880dbf849d041a96a61de84611c040bf674899bc0ecab693afe2cf911aa37cb537b83ecfd11525fce0d4758bdabe68092d17c6b5e2f4cde3fd58dc96f14bbf15

    • SSDEEP

      196608:EH14G7PwPWpGplR806IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIA8Zk:FPWpGplR8ZWk

    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral11

MITRE ATT&CK Enterprise v15

Tasks