MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 15


Intelligence 15 IOCs YARA 7 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d
SHA3-384 hash: b8a361cad14ac6ad40900d95c1d2a77f3c71f99e579a0fb567713882157d5af52b980f153870a77c3e96a2390bee16e1
SHA1 hash: 81fe95e788ec844740b1e3fa59a66fd81e766c62
MD5 hash: e41099316a6272c73e80c90972c3203e
humanhash: alaska-speaker-beer-pizza
File name:e41099316a6272c73e80c90972c3203e
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:1'817'088 bytes
First seen:2023-10-26 08:20:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'873 x AgentTesla, 19'796 x Formbook, 12'305 x SnakeKeylogger)
ssdeep 24576:7BFSahVA/W2E/PDi6+rHmN9jRkQfcQUKDp/eSTZZ9tRccrVhmb:9sag+B/8aDjrBUIQS3PFrq
Threatray 110 similar samples on MalwareBazaar
TLSH T12D85F1947BC4467DD13CFE7A9AE5808A67B6B8D72317F01A5FC6FDD8423290A0B41D28
TrID 71.1% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.2% (.EXE) Win64 Executable (generic) (10523/12/4)
6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.3% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.ICL) Windows Icons Library (generic) (2059/9)
File icon (PE):PE icon
dhash icon e49e262324242226 (1 x RevengeRAT)
Reporter zbetcheckin
Tags:32 exe RevengeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
368
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Reserva Detalhes.ppam
Verdict:
Malicious activity
Analysis date:
2023-10-26 07:07:57 UTC
Tags:
macros macros-on-open revengerat
Link:
https://app.any.run/tasks/1bb70608-08b2-444c-a019-557207c1766f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RevengeRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/456502/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.28119.14950.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %temp% directory
Launching a process
Creating a file
Creating a process from a recently created file
Query of malicious DNS domain
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
jsc lolbin packed
Link:
https://www.filescan.io/uploads/653a2170a6fa5eab936739eb/reports/1c2a4921-8072-47d5-ac74-fe8447be469c/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RevetRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f609f63f-46f3-4ade-a1c5-7f9b36f9be26
Result
Threat name:
RevengeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1332525
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Found malware configuration
Found RAT behaviour (information extraction to be send to C&C)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Suspicious powershell command line found
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected RevengeRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1332525 Sample: 1KozdG7nJH.exe Startdate: 26/10/2023 Architecture: WINDOWS Score: 100 36 marcelotatuape.ddns.net 2->36 38 Multi AV Scanner detection for domain / URL 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 7 other signatures 2->44 8 1KozdG7nJH.exe 4 2->8         started        12 teste2.exe 2->12         started        signatures3 process4 file5 30 C:\Users\user\AppData\Local\...\teste2.exe, PE32 8->30 dropped 32 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 8->32 dropped 46 Suspicious powershell command line found 8->46 48 Writes to foreign memory regions 8->48 50 Allocates memory in foreign processes 8->50 14 teste2.exe 1 8->14         started        17 jsc.exe 2 8->17         started        20 powershell.exe 1 23 8->20         started        24 2 other processes 8->24 52 Injects a PE file into a foreign processes 12->52 22 jsc.exe 12->22         started        signatures6 process7 dnsIp8 54 Multi AV Scanner detection for dropped file 14->54 56 Machine Learning detection for dropped file 14->56 58 Writes to foreign memory regions 14->58 60 2 other signatures 14->60 26 jsc.exe 1 14->26         started        34 marcelotatuape.ddns.net 141.255.145.44, 333 IELOIELOMainNetworkFR France 17->34 28 conhost.exe 20->28         started        signatures9 process10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d/
Threat name:
ByteCode-MSIL.Trojan.LummaStealer
Create hunting rule
Status:
Malicious
First seen:
2023-10-26 08:12:47 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
20 of 23 (86.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyrwfrjohgfu2kg5sctllmjhgep7f7mk4mbj55umzxgl4yzblsoq._file
Verdict:
malicious
Similar samples:
3b51460702df54688fa2aff8d0b63eb5c254ef4c9bae60a77b3e3e52dc4d4272
RevengeRAT
4b956b7f9addbca5bc0325710143086cea840a11f3bcac9264019094f0c6b754
RevengeRAT
522b247f0eb767043d3b55c1ae91158b0bdcf2d0de93dac727accef6f133b497
RevengeRAT
89d87ad9e7e6da0523ea6a151b216627dade1d2120c1d730dfd730888fe79a3c
RevengeRAT
8a323c15d9371a15cedf914b75c2887a399d7372e0a0ed7107cec899b41472ee
RevengeRAT
9648c6034468d7ee150c2b9b2ce088c14793e1ddf235d596ce14ef754e7d1e9f
RevengeRAT
de07700b778968ae841d1a76362b7387b38f79d0d46854aaf6417176be40f659
RevengeRAT
e065676a6d3fd822fed9b2a99771a1355035f63873142fa3999cb69659a984d8
RevengeRAT
+ 100 additional samples on MalwareBazaar
Result
Malware family:
revengerat
Create hunting rule
Score:
  10/10
Tags:
family:revengerat botnet:nyancatrevenge persistence trojan
Link:
https://tria.ge/reports/231026-j8zr9sfb51/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
RevengeRAT
Malware Config
C2 Extraction:
marcelotatuape.ddns.net:333
Unpacked files
SH256 hash:
182f57d8c89fee4667fbb3420a9877b8198c4b9d0867660172c13dd9044f6f64
MD5 hash:
626b2239011878b0d6b779006bd66a91
SHA1 hash:
c79ecfe4c27d42c9d8f88a0be738790c56143d7d
Link:
https://www.unpac.me/results/43d92765-5fe5-41e9-abc5-36be93d999c4/
SH256 hash:
6a26df7ee49de6fec6c5de1f3f7a94075d2dfbc50922e3b30fd8111f2e734f33
MD5 hash:
f45c1512d5a47375e6e396b4d1111e58
SHA1 hash:
8af036b8c60d10e85cf82212930bb04bc0553f36
Link:
https://www.unpac.me/results/43d92765-5fe5-41e9-abc5-36be93d999c4/
SH256 hash:
f771d47090fb0e6a86188c4e2cb17af60adeb48b27e805f8f86f70dd7298057e
MD5 hash:
7ba32c3de796932ce812194b60f6a388
SHA1 hash:
80ca37e36762800c8fc66cd06fcea510048f3e38
Detections:
win_revenge_rat_g2
Create hunting rule
Link:
https://www.unpac.me/results/43d92765-5fe5-41e9-abc5-36be93d999c4/
SH256 hash:
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd
MD5 hash:
544cd51a596619b78e9b54b70088307d
SHA1 hash:
4769ddd2dbc1dc44b758964ed0bd231b85880b65
Link:
https://www.unpac.me/results/43d92765-5fe5-41e9-abc5-36be93d999c4/
SH256 hash:
562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d
MD5 hash:
e41099316a6272c73e80c90972c3203e
SHA1 hash:
81fe95e788ec844740b1e3fa59a66fd81e766c62
Link:
https://www.unpac.me/results/43d92765-5fe5-41e9-abc5-36be93d999c4/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/562362c52e39/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_RevengeRAT
Create hunting rule
Author:ditekSHen
Description:RevengeRAT and variants payload
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Revengerat_db91bcc6
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RevengeRAT

Executable exe 562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2725983/
Cape
Cape
https://www.capesandbox.com/analysis/456502/

Comments


Avatar
zbet commented on 2023-10-26 08:20:34 UTC

url : hxxps://www.4sync.com/web/directDownload/NRrKch5Y/cmlUXrEx.ec6924e67c8d2c0fb427df950869232a/