Extracted

• • Target
    sample
  • Size 293KB
  • SHA256 b8200b8a6951f153b55cb09f7f3f5fceef571f87be6c0c7a8459ff11d00cd296
  • MD5 4b9c577f4c7e20896c62079fa62d1a60
  • SHA1 12bad677637d19d587c0878d96c3785c4d9c611d
  • SHA512 7dc10547b3280beddc37f9b44bafc9b3e6ff073fe275cde442bfcb196fe661fc29adc7389db3bdb580ea62c08d2f39976080c76f31565b3403d1f3cc24336c3e
  • SSDEEP 3072:GYEDmwzqMgpRbIJ6PFtlf7wVG0/yb5QQ/3IkWXFhy5hL1:GYEDmwzqXpdIJ6B7wVGpVd3IPUL1
  • TLSH
    T10D545B726200B43BB913DDA093BE7F0E3C26E26BDC0646F8A595E534CBE2EB1151671D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwareguestdefense_evasiondiscoveryexecutionrevengeratpersistenceprivilege_escalationspywarestealertrojanupx

  • Family: RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Modifies WinLogon for persistence

    persistence

  • RevengeRat Executable

    stealer

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2