Overview

overview

10

Static

static

10

dcf4f5026b...05.exe

windows7-x64

10

dcf4f5026b...05.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dcf4f5026b6089dd04778bf9c239f76c1c6496228328e2e33d520eb07ce08105.exe

  • Size

    558KB

  • Sample

    241123-229yrs1nay

  • MD5

    dd11e7cfd1690fc9973d634dc936b312

  • SHA1

    60fdaf4d062b8172dab25b1af50e2e6b1c7e070e

  • SHA256

    dcf4f5026b6089dd04778bf9c239f76c1c6496228328e2e33d520eb07ce08105

  • SHA512

    41f12b26dd961ca2274dd6db5a05a046ae3bc38e5e795b0e197761876bb023aaad2cecb60be6626c734d391ea48c141f7ccea03cfb2acc79e7d367749e4210c3

  • SSDEEP

    12288:6h7nbLXaRfbWGBJ/tayfH2x9j+pTmX5WE6f1YKEJRzI:6h7n/XOWGLVfvO9sTmp8f1UJC

Score
10/10
revengeratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      dcf4f5026b6089dd04778bf9c239f76c1c6496228328e2e33d520eb07ce08105.exe

    • Size

      558KB

    • MD5

      dd11e7cfd1690fc9973d634dc936b312

    • SHA1

      60fdaf4d062b8172dab25b1af50e2e6b1c7e070e

    • SHA256

      dcf4f5026b6089dd04778bf9c239f76c1c6496228328e2e33d520eb07ce08105

    • SHA512

      41f12b26dd961ca2274dd6db5a05a046ae3bc38e5e795b0e197761876bb023aaad2cecb60be6626c734d391ea48c141f7ccea03cfb2acc79e7d367749e4210c3

    • SSDEEP

      12288:6h7nbLXaRfbWGBJ/tayfH2x9j+pTmX5WE6f1YKEJRzI:6h7n/XOWGLVfvO9sTmp8f1UJC

    Score
    10/10
    revengeratdiscoverypersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks