Overview

overview

10

Static

static

3

Claws.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Claws.exe

  • Size

    169KB

  • Sample

    250413-bk12esv1ez

  • MD5

    7722c519958c86885ca19a7d9940b9c8

  • SHA1

    bb0c80aa03b1b9f3675f0a827a35f54d73b83a15

  • SHA256

    c516c1a413288af6311756bf33692d514d811e9d7dbbc7d873065f8bae6f32bb

  • SHA512

    c0591c7f8682a643a5d41d3add9464a2bac2bc86b70b8b67613cb20f7f40d607deb64e9bf823c9cf4991547ff42c6f1279e548b54dbab954bad24cdc9b65006b

  • SSDEEP

    3072:YLb2/QzfuruwSg1YyRyaAlYLC1ERXEqYPhVdU9HOcLkl+KUS:5M2OWYGyLlYW2uKBOcAUS

Score
10/10
revengeratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      Claws.exe

    • Size

      169KB

    • MD5

      7722c519958c86885ca19a7d9940b9c8

    • SHA1

      bb0c80aa03b1b9f3675f0a827a35f54d73b83a15

    • SHA256

      c516c1a413288af6311756bf33692d514d811e9d7dbbc7d873065f8bae6f32bb

    • SHA512

      c0591c7f8682a643a5d41d3add9464a2bac2bc86b70b8b67613cb20f7f40d607deb64e9bf823c9cf4991547ff42c6f1279e548b54dbab954bad24cdc9b65006b

    • SSDEEP

      3072:YLb2/QzfuruwSg1YyRyaAlYLC1ERXEqYPhVdU9HOcLkl+KUS:5M2OWYGyLlYW2uKBOcAUS

    Score
    10/10
    revengeratdiscoverypersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks