Extracted

• • Target

    Client.exe

  • Size

    111KB

  • MD5

    688a4cb70081d9edb63c1c1aa41487e1

  • SHA1

    3efe438b2b4a44f2dc7f02c6e1afe980e2a116d8

  • SHA256

    4f6242573cd5b7b50a3091449e2df40fa3005d14a0389931b948782d11ab27e9

  • SHA512

    4f5ef2d0538a3a38748d4c2378e15cd91bd0073ac28e093be7cb86a2d9ef29aaa667f07a516a169bd0e44ab09202914c8bdae9cf5cd1f5d543ebf3388222ad2b

  • SSDEEP

    3072:0Bx88hg1dtEGiymTRNE18lEqtYDeQ9SYp1+:0w8OmTRNE14WDF7p1+

  Score

  10^/10

  revengeratguestdiscoverypersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2