Extracted

• • Target

    installer.exe

  • Size

    241KB

  • MD5

    b3004a21d724c3a634bd9411b8628713

  • SHA1

    119c7a16e2e2e2689e8a376b97bec6a80fd6b3fc

  • SHA256

    66e59f5c1780a57b6c267f84a71a901c64321607fc4d06714f6c0a6e89b075d7

  • SHA512

    2c4c1caac46bab3bee953dd6105db034a6b52946ed566d4b5a84aa3aea48318db0452891ab931bef10d13677b12e91f197052a19281fb8baedfa802a6ce3b951

  • SSDEEP

    3072:iLtFhVdQjEkzKd6SCs0be9RDcGg5aL2/QzfuruwSg1YyRyaAlYLC1ERXEqYPhVd9:AVdQjEzFV2DM2OWYGyLlYW2uKBOcAUS

  Score

  10^/10

  revengeratsalitybackdoordefense_evasiondiscoverypersistencestealertrojanupx

  • Modifies firewall policy service

    defense_evasion

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1