revengerat | adb45d32e594ac2ec1598b9272d41f13c6f02f3e7b9a246cc93d1d00a53ebc9c[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

adb45d32e594ac2ec1598b9272d41f13c6f02f3e7b9a246cc93d1d00a53ebc9c.exe
Size

330KB
MD5

b4c43aac90ebfdff825363d99dd93e7a
SHA1

45dca59dbbf512e66417a44bbfa2ea69b4e34b1b
SHA256

adb45d32e594ac2ec1598b9272d41f13c6f02f3e7b9a246cc93d1d00a53ebc9c
SHA512

86c20e661fd5192b821e32d5f0cb0bf9fa815009f1ede6bb1143a6ea23e927006e17e0d94ffdc966296471116510ec757372757787eb66b15da2167c166156ea
SSDEEP

3072:WkCaLgjKrY+6JhE58JeJ8DokH68mYkoQ36vdqDVkEmx3nBMFxbwOo25E2VWvQuBh:uaLa1CHqDokH680oFlHZ3nBS02VWDGgV

Score

10^/10

stealer revengerat

Malware Config

Signatures

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
sample	revengerat

Revengerat family
revengerat

Files

adb45d32e594ac2ec1598b9272d41f13c6f02f3e7b9a246cc93d1d00a53ebc9c.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-08-2018 20:20

Not After

23-11-2019 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5d
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-09-2018 20:38

Not After

06-09-2019 20:38

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0a:59:2b:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

11-02-2016 23:24

Not After

09-05-2021 23:28

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03-07-2018 20:45

Not After

26-07-2019 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:b8:d9:87:9c:58:43:94:0d:06:a0:1b:93:1b:e1:58:17:b4:67:df:21:20:3a:f2:bb:04:49:3a:73:4f:85:58
Signer

Actual PE Digest

dd:b8:d9:87:9c:58:43:94:0d:06:a0:1b:93:1b:e1:58:17:b4:67:df:21:20:3a:f2:bb:04:49:3a:73:4f:85:58

Digest Algorithm

sha256

PE Digest Matches

false

b1:1b:4c:e7:da:da:d3:90:ac:90:a5:92:c3:46:63:3a:ad:23:85:1b
Signer

Actual PE Digest

b1:1b:4c:e7:da:da:d3:90:ac:90:a5:92:c3:46:63:3a:ad:23:85:1b

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 354B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0dCertificate

Extended Key Usages

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5dCertificate

Extended Key Usages

61:0a:59:2b:00:00:00:00:00:3bCertificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

dd:b8:d9:87:9c:58:43:94:0d:06:a0:1b:93:1b:e1:58:17:b4:67:df:21:20:3a:f2:bb:04:49:3a:73:4f:85:58Signer

b1:1b:4c:e7:da:da:d3:90:ac:90:a5:92:c3:46:63:3a:ad:23:85:1bSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 265KB - Virtual size: 265KB

.sdata Size: 512B - Virtual size: 354B

.rsrc Size: 48KB - Virtual size: 47KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:01:0d:4b:e1:d4:0b:2c:ea:40:22:00:00:00:00:01:0d
Certificate

33:00:00:00:5d:47:bb:9d:78:1c:f7:91:0c:00:01:00:00:00:5d
Certificate

61:0a:59:2b:00:00:00:00:00:3b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:01:c3:13:a0:85:c3:56:e2:99:d7:00:00:00:00:01:c3
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

dd:b8:d9:87:9c:58:43:94:0d:06:a0:1b:93:1b:e1:58:17:b4:67:df:21:20:3a:f2:bb:04:49:3a:73:4f:85:58
Signer

b1:1b:4c:e7:da:da:d3:90:ac:90:a5:92:c3:46:63:3a:ad:23:85:1b
Signer

.text
Size: 265KB - Virtual size: 265KB

.sdata
Size: 512B - Virtual size: 354B

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 512B - Virtual size: 12B