Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
Client4PM..exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Client4PM..exe
Resource
win10v2004-20240802-en
General
-
Target
Client4PM..exe
-
Size
467KB
-
MD5
b46e938e455f07908b277bacaf40c1b8
-
SHA1
10b0d817957340cf35df3b20a37a14ec12ccf34a
-
SHA256
a621f7d758f70c986ebc40d2e9ad89187a4659f1e26ae33af6b19557c0074038
-
SHA512
965da90a55b382b78e385e20f1714541ac64b2c9e62605cf0b14513d21a5e181b6def0e9df04f74cb55759b070a399c5593142476da15358cdf022d1b00eb8c7
-
SSDEEP
3072:md3MwOibhTsNElLD5CbwDa9SY4AwZB7uy6W:md3BhTsNElLDzD+7PwTam
Malware Config
Extracted
revengerat
Guest
127.0.0.1:333
RV_MUTEX
Signatures
-
RevengeRat Executable 1 IoCs
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Client4PM..exe
Files
-
Client4PM..exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 362KB - Virtual size: 361KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ