MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ed07cd100c933c766b2183c8c46f913116bc89b2651e22c3dd5a61c06913b7a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0ed07cd100c933c766b2183c8c46f913116bc89b2651e22c3dd5a61c06913b7a
SHA3-384 hash: 4fd88ed26ce66a112821506f5c3feb440237dc911711b8262dc9b65ea8ddcd8df3adecb7428a961801693710c540561a
SHA1 hash: e3ad37a856a2eec5d5b0089ef912345d779a73c7
MD5 hash: 312b35814de5775ee3d8c28fd47397f9
humanhash: foxtrot-spaghetti-mockingbird-mars
File name:0ed07cd100c933c766b2183c8c46f913116bc89b2651e22c3dd5a61c06913b7a
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:146'944 bytes
First seen:2020-06-29 07:37:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 3072:Nyi3iR+p2/71AeyQk2mtEZzLCRP8K6h9YSNJiVolsr:NyZR9/7pBmtEZzLbHfid
Threatray 36 similar samples on MalwareBazaar
TLSH 73E34A2DB74B8F22C5AC1A7990E6784027B073476B33EA0A5D9C50ED5EC33521A0A5EF
Reporter JAMESWT_WT
Tags:RevengeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
415
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15801/
Detection(s):
Win.Trojan.Generic-6332612-0
Create hunting rule

Win.Malware.Razy-6862379-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0ed07cd100c933c766b2183c8c46f913116bc89b2651e22c3dd5a61c06913b7a/
Threat name:
ByteCode-MSIL.Trojan.Perseus
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 07:11:00 UTC
File Type:
PE (Exe)
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b3ihzuiazez4ozvsda6iyrxzcmiwxse3ezi6elb52wtbyburhn5a._file
Verdict:
suspicious
Similar samples:
03f5db6aa8252bf8ffaaf6a9e843567ba4bf228bd3309449b16e03e303fd7c12
RevengeRAT
1ff495dacc5d548ac9899ec1622b0408b9948ac485f0f7d782d2a3cabe94e2b8
RevengeRAT
284f5d7c77eab431e6dd8bdd9e508bbd1e2e3dc467b40f68b834b1a437061061
RevengeRAT
2d1ed3f838936881bbcce13d13dd480e70ced0e796e6d6acd9b563dcc0c6696d
RevengeRAT
8621d034aa3d308052ba9371dca6cf2d5a5b043b2903d3005c21f368525abde8
RevengeRAT
9ed8b4aa4693089d71da648dcc5a33cb2263d82cd522140e063d3150747a2f6d
RevengeRAT
b9f3224ab5b74db881ce36d3177812635ee6accae03a86c5beec94c095eaa105
RevengeRAT
c656d7d18181d06dc4ffa7a0477f44c5ba4e891c18bb66ba31f8f8ddba22f742
RevengeRAT
e11cee0b37bd2b81d98d9cf14de0c549c4d539791d3ad8430993a2ff9eab6c7b
RevengeRAT
e939047540fd58d605f6e259e9be2e2370f51e79246b34c2d01acc94cb19b4dc
RevengeRAT
+ 26 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/200629-dlqvvg4en6/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Uses the VBS compiler for execution
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RevengeRAT_Sep17
Create hunting rule
Author:Florian Roth
Description:Detects RevengeRAT malware
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15801/

Comments