Extracted

• • Target

    a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8

  • Size

    959KB

  • MD5

    2873ffc6801b6f646d9f14f339e7e550

  • SHA1

    23329c57d5e345e5f5d5aff41164168e6e3228a6

  • SHA256

    a303abeb45c17496d1134401d5f1e4e6804e6bf0ce192b28ec73951d1ee361c8

  • SHA512

    16fdd7a22e01b5b5eb39b92c1ee96df0aa355a3a47d14f08ce887f3684cef65250d7675c035dab6de79054a0d39237746aa4aa67d055872643edb9753a9458cb

  • SSDEEP

    12288:j6oLLoS60/K7yh0necHIgCIzoLLZefb06B+lHDBb+qL2pG3N8XNC834U:j6oLAehgCpgfb0W+x4GQ74U

  Score

  10^/10

  revengeratdownloaderdiscoverytrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2