revengerat | 0877a4b59573a412c1c258552c4bec59d009ce2886311d145fdd9359d662f7ae | Triage

Sharing

General

Target

0877a4b59573a412c1c258552c4bec59d009ce2886311d145fdd9359d662f7ae
Size

789KB
MD5

4a1b7d6384bec43d3747e1fa6be90ae9
SHA1

ceb558cc99c08aee31b158c660d32a7bcfd0bf11
SHA256

0877a4b59573a412c1c258552c4bec59d009ce2886311d145fdd9359d662f7ae
SHA512

cd4e8bb600cb15358c6a4e8eab6aeb2aea422a151ce6681979039dfa14443566a09085309f31219bd1dfe520d113d4f385fe086551b895da694715210ffb8361
SSDEEP

12288:SZwZ7H8Fq0lDe5R42ywhRkyI6G6OaPBqvQhoagXDaP6n32ZN/nj3TKT:SZKj8F1De52wVPBq4hoagXD7nGrvK

Score

10^/10

stealer revengerat

Malware Config

Signatures

RevengeRat Executable 1 IoCs

Processes:

resource	yara_rule
sample	revengerat

Revengerat family
revengerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
0877a4b59573a412c1c258552c4bec59d009ce2886311d145fdd9359d662f7ae

Files

0877a4b59573a412c1c258552c4bec59d009ce2886311d145fdd9359d662f7ae
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

BL1200.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 784KB - Virtual size: 783KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ