Extracted

• • Target

    db1bed0fcb8b96baabc8163efc6c3f32726f8840ca135a741a35c7abd6c04018.exe

  • Size

    1.7MB

  • MD5

    570388d87360d6bd982993aedaddbac0

  • SHA1

    883499305bb02ac67ab22688ce1f6c6fb2c13bdb

  • SHA256

    db1bed0fcb8b96baabc8163efc6c3f32726f8840ca135a741a35c7abd6c04018

  • SHA512

    0f5afd85cd6cfb3958cf5fc1aeaba2872eb1218bb5da86a93ff2148b3a5eaf2b69c38786841106b6bd72e215309ecaab2a61a0d864f0703691fc1499d469d054

  • SSDEEP

    49152:vcGL0yvl07QwY4AYgH1DsAyhYtzo/V/8I56KHygdmQPgQvz2/:vcGTvDwYvHOdozm8I5nygdnJb2/

  Score

  10^/10

  revengeratguestdiscoverypersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2