C:\墨香書院全套\墨香書院全套\書院使用方法登入器\AutoPatchSource\[Client]\MHAutoPatch\MHAutoPatch\obj\x86\Release\MHAutoPatch.pdb
Behavioral task
behavioral1
Sample
3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566.exe
Resource
win10v2004-20241007-en
General
-
Target
3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566.exe
-
Size
418KB
-
MD5
dd2a3f0e2dcc7827047be0d194d9ccf7
-
SHA1
389945b183590f707d4c29ec9b914b4b277f1766
-
SHA256
3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566
-
SHA512
3614244994e26d18af40ab99e899c7716099dc775e0fd130aafcc596254d63093823123ef50c0b38772ed54892531663205da750908e8befa0af8c9df706aacf
-
SSDEEP
6144:jVZrcaN1W8KBS6HD3ew3mCVZrcaN1W8KBS6HD3ew3miyquN9fGVZrc6N1W8KBS6N:jTAaTodPTAaTodbTA6TodaY
Malware Config
Signatures
-
RevengeRat Executable 1 IoCs
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566.exe
Files
-
3d2a441b46563f183e41ff108944b8630f543a09978b5085d38ee0af1e1ea566.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 287KB - Virtual size: 287KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ