MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RevengeRAT

Vendor detections: 9

Intelligence 9 IOCs YARA 4 File information Comments

SHA256 hash:	230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4
SHA3-384 hash:	92cf7ca92024504dce709a645f216213b78cfc0039a472a8a2d6f0be4d7da5044fdded1fd62243300eae074984b8b6ce
SHA1 hash:	5666951946ea4e050cfdf7abf51ea1be403e76bf
MD5 hash:	8e2c2ac7fbda44d67e6f75adfb0195c3
humanhash:	alpha-monkey-orange-black
File name:	8e2c2ac7fbda44d67e6f75adfb0195c3.exe
Download:	download sample
Signature	RevengeRAT Create hunting rule
File size:	304'640 bytes
First seen:	2022-02-03 14:46:37 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ba701d625d9fe4b055c54b1b9449630d (1 x RevengeRAT)
ssdeep	3072:xfAV35gByp6aJXAAum5xX0K8WtvMfADT:1g3WBy6WtvMo
Threatray	523 similar samples on MalwareBazaar
TLSH	T13F5421E267166876C962537C4271C67A923B3E983763D34B61E5FC673F331C21CA6882
File icon (PE):
dhash icon	0070f0f0f0f07008 (1 x RevengeRAT)
Reporter	abuse_ch
Tags:	exe RevengeRAT

Intelligence

File Origin

# of uploads :

# of downloads :

597

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/232284/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.38827319.24638.15895.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

DNS request

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/5880/overview

Behaviour

MalwareBazaar

MeasuringTime

EvasionQueryPerformanceCounter

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm control.exe greyware packed

Link:

https://www.filescan.io/uploads/61fc316ea0f6a794b33693f2/reports/7701528c-6bab-4cd1-aa2f-407081c9f72f/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0cca2cb5-ea90-492d-a764-6d4fb500a066

Result

Threat name:

RevengeRAT

Detection:

malicious

Classification:

troj.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/933448

Behaviour

Behavior Graph:

n/a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4/

Threat name:

Win64.Trojan.Phonzy

Status:

Malicious

First seen:

2022-01-31 00:51:08 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

21 of 43 (48.84%)

Threat level:

5/5

Verdict:

malicious

RevengeRAT

26a4c5b36d9fde80ea47137eb53b40dacf240432a5895f98417eae51b6b681da

RevengeRAT

273ad5a2b3f62bd80b72a345fc153d30f3852301ed8d60ad40584086d7ee7735

RevengeRAT

4e7105da7face5917f66842ba73810d29826cb971140f9da2b0efb7a37de3c0e

RevengeRAT

51037666d1982db93e3123e88594d409805d3f1d970e9f926dcadb99f77f50f6

RevengeRAT

5879d39a0bab80032ebc751728e034cf7ec7fb30749090b5df8c37100034ef95

RevengeRAT

914cd602a58f69dd35dd207d8128807926a139f27f4d8b7b2b958041783bc10c

RevengeRAT

adf8e5128003e712d0e1e7d0b3833864971711c03c8099bfcf369ab6764d5415

RevengeRAT

babf526ebe596643961a64b67dea3846f45355f4852f560046f06b633141b2a3

RevengeRAT

eb6b810f2cb85c0a1a028c53e4c346b3ec7601d1853758c3b8ce56eac6f96be8

RevengeRAT

+ 513 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

persistence

Link:

https://tria.ge/reports/220203-r5wv7sagak/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

Drops file in Windows directory

Adds Run key to start application

Downloads MZ/PE file

Executes dropped EXE

Sets service image path in registry

Unpacked files

SH256 hash:

230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4

MD5 hash:

8e2c2ac7fbda44d67e6f75adfb0195c3

SHA1 hash:

5666951946ea4e050cfdf7abf51ea1be403e76bf

Link:

https://www.unpac.me/results/357fa082-221a-4dfe-99f8-ffcd029a6cac/

Malware family:

RevengeRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/230afb514486/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	dsc Create hunting rule
Author:	Aaron DeVera
Description:	Discord domains

Rule name:	INDICATOR_SUSPICIOUS_EXE_DiscordURL Create hunting rule
Author:	ditekSHen
Description:	Detects executables Discord URL observed in first stage droppers

Rule name:	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing URLs to raw contents of a Github gist

Rule name:	SUSP_PE_Discord_Attachment_Oct21_1 Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:	Internal Research