revengerat | eb5b10a9f429ad6b96e6a1438f21120abe791c8b150f547a36c948dcbf38dcbcN[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

eb5b10a9f429ad6b96e6a1438f21120abe791c8b150f547a36c948dcbf38dcbcN.exe
Size

330KB
MD5

a609a93922ca6438097106c1d71602f0
SHA1

061cafa8aad40b665f78001d1fe11861800b19a3
SHA256

eb5b10a9f429ad6b96e6a1438f21120abe791c8b150f547a36c948dcbf38dcbc
SHA512

c7f578f898cea208ed91a28bac144ffe929933349d5e111b45f08933436e1287b6de5e0133bc3ce5d1dc6202c15b2e102626c09058226ae4daf3e42b498ce662
SSDEEP

3072:WkCaLgjKrY+6JhE58JeJ8DokH68mYkoQ36vdqDVkEmx3nBMFxbwOo25E2VWvQuB7:uaLa1CHqDokH680oFlHZ3nBS02VWDGg

Score

10^/10

stealer revengerat

Malware Config

Signatures

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
sample	revengerat

Revengerat family
revengerat

Files

eb5b10a9f429ad6b96e6a1438f21120abe791c8b150f547a36c948dcbf38dcbcN.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-08-2018 20:20

Not After

23-11-2019 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5d
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-09-2018 20:38

Not After

06-09-2019 20:38

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0a:59:2b:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

11-02-2016 23:24

Not After

09-05-2021 23:28

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:27:68:cf:43:5d:54:9f:2f:94:4d:a3:5a:f3:59:be:b6:c6:f8:c1:15:5c:32:2c:08:78:7a:b7:a7:9c:2b:e5
Signer

Actual PE Digest

5f:27:68:cf:43:5d:54:9f:2f:94:4d:a3:5a:f3:59:be:b6:c6:f8:c1:15:5c:32:2c:08:78:7a:b7:a7:9c:2b:e5

Digest Algorithm

sha256

PE Digest Matches

false

69:a2:67:13:e9:2a:de:3c:ed:24:73:ee:ff:af:a0:37:4c:57:6a:6b
Signer

Actual PE Digest

69:a2:67:13:e9:2a:de:3c:ed:24:73:ee:ff:af:a0:37:4c:57:6a:6b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0dCertificate

Extended Key Usages

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5dCertificate

Extended Key Usages

61:0a:59:2b:00:00:00:00:00:3bCertificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

5f:27:68:cf:43:5d:54:9f:2f:94:4d:a3:5a:f3:59:be:b6:c6:f8:c1:15:5c:32:2c:08:78:7a:b7:a7:9c:2b:e5Signer

69:a2:67:13:e9:2a:de:3c:ed:24:73:ee:ff:af:a0:37:4c:57:6a:6bSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 265KB - Virtual size: 265KB

.sdata Size: 512B - Virtual size: 354B

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0d
Certificate

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5d
Certificate

61:0a:59:2b:00:00:00:00:00:3b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

5f:27:68:cf:43:5d:54:9f:2f:94:4d:a3:5a:f3:59:be:b6:c6:f8:c1:15:5c:32:2c:08:78:7a:b7:a7:9c:2b:e5
Signer

69:a2:67:13:e9:2a:de:3c:ed:24:73:ee:ff:af:a0:37:4c:57:6a:6b
Signer

.text
Size: 265KB - Virtual size: 265KB

.sdata
Size: 512B - Virtual size: 354B

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 512B - Virtual size: 12B