revengerat | eb443a1c7b58fbaa19b881df3108ca044a7cffd4[.]rl[.]zip

General

Target
eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl.zip
Size 2.6MB
Sample241105-ttv6msvern
SHA256 aa02c20205915a494154dac55a1956d4465937d7c5fc139866b9500bea6e8872
MD5 b608ed0618d454f8a76e2fb155626855
SHA1 57fc57fb165c290df69767cd6378990062945e0c
SHA512 85f9a7d46b8e7a19e6be2819df2b107ef79db54858baaffeb418ac06ca188d3c33eedd97723d686b7a3f64ff4ec1a6e5b52d1f606d63387ce6759cd4ece13850
SSDEEP 49152:9Sp6Le0uS+OK4Zy/OXbMbk5xeyTflq4EgRy1MoL4tcqdRmEdQHAAocwccN:oS+OK4Z8kzZxrEgRyqoL4GoQgABw5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

themida revengerat

Malware Config

Signatures

Revengerat family
revengerat

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
static1/unpack001/eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl

File Explorer

eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl.zip

.zip 2.6MB
eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl

.exe 2.6MB

eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl.zip

SHA256 aa02c20205915a494154dac55a1956d4465937d7c5fc139866b9500bea6e8872
MD5 b608ed0618d454f8a76e2fb155626855
SHA1 57fc57fb165c290df69767cd6378990062945e0c
SHA512 85f9a7d46b8e7a19e6be2819df2b107ef79db54858baaffeb418ac06ca188d3c33eedd97723d686b7a3f64ff4ec1a6e5b52d1f606d63387ce6759cd4ece13850
SSDEEP 49152:9Sp6Le0uS+OK4Zy/OXbMbk5xeyTflq4EgRy1MoL4tcqdRmEdQHAAocwccN:oS+OK4Z8kzZxrEgRyqoL4GoQgABw5
MD5 SHA1 SHA512 SSDEEP

Password

infected

eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl

SHA256 76d6628597ba81b5e7001864c50854a82b5d3e0e401a06a22317304f603876c1
MD5 65b06b40fce0f320a7a7cdb78d4f9655
SHA1 eb443a1c7b58fbaa19b881df3108ca044a7cffd4
SHA512 f5583153e8f36baa597a39cab30ae5de530849f52c5bf18ac129756d25d686cc576cbf15fd68eb601ee9306cba9f528226a0b4509415e47ff6603c4184400e1d
SSDEEP 49152:n7IAuAriItPRvlYBIzFazl6tcepNibPK+cp23+5/N0Lf8ZahS/0fGzZSBK5ev+HD:n7IAubI2+zFm6QbyZp2g21GzGv+PJh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4358232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.imports

Size

512B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.boot

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl.zip

eb443a1c7b58fbaa19b881df3108ca044a7cffd4.rl

generic