MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a
SHA3-384 hash: 40698d271a91cf11bdd97601de4cb34706f203dd11654ecea28d66c9898e200b7928ab04b0d96a54753f0710d30c9f9f
SHA1 hash: 9891f98372ad8b7f85abc5e9399726496dbe203a
MD5 hash: 385b9916d255f7b6e411e39f6cab3623
humanhash: mockingbird-mars-batman-bravo
File name:385B9916D255F7B6E411E39F6CAB3623.exe
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:420'352 bytes
First seen:2021-06-20 16:40:56 UTC
Last seen:2021-06-20 17:34:31 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'741 x AgentTesla, 19'604 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:zNWsBCNCmud0HvgL/A4S2XxSib7An0X6YmHs3+GNA6SAzn6Piz:zCM0M/P7xSw7AnkNFdmAj6Pi
Threatray 81 similar samples on MalwareBazaar
TLSH 419412184F9107C5C9C64AB0133E2FDB49795F7A8077C1E6ACA53C459B2DAE3A053FA2
Reporter abuse_ch
Tags:exe RevengeRAT


Avatar
abuse_ch
RevengeRAT C2:
105.190.59.121:2222

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
105.190.59.121:2222 https://threatfox.abuse.ch/ioc/137731/

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'075
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
385B9916D255F7B6E411E39F6CAB3623.exe
Verdict:
Malicious activity
Analysis date:
2021-06-20 16:41:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b25529a1-d1ba-4394-b368-d7383e07644b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RevengeRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/167207/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader23.12367.31552.20679.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/efe37d08-567e-497e-a215-2489240cd350
Result
Threat name:
RevengeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804956
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Uses dynamic DNS services
Yara detected Beds Obfuscator
Yara detected RevengeRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 437367 Sample: vaFyOeMI0s.exe Startdate: 20/06/2021 Architecture: WINDOWS Score: 100 59 Malicious sample detected (through community Yara rule) 2->59 61 Antivirus detection for dropped file 2->61 63 Antivirus / Scanner detection for submitted sample 2->63 65 11 other signatures 2->65 9 vaFyOeMI0s.exe 6 2->9         started        13 Windows Support.exe 2->13         started        15 Windows Support.exe 2->15         started        17 Windows Support.exe 2->17         started        process3 file4 45 C:\Users\...\ValorantCheckerByTharwaT.exe, PE32+ 9->45 dropped 47 C:\Users\user\AppData\...\Runtime Broker.exe, PE32 9->47 dropped 49 C:\Users\user\AppData\...\vaFyOeMI0s.exe.log, ASCII 9->49 dropped 69 Hides that the sample has been downloaded from the Internet (zone.identifier) 9->69 19 Runtime Broker.exe 3 9->19         started        21 ValorantCheckerByTharwaT.exe 9->21         started        24 Windows Support.exe 13->24         started        26 Windows Support.exe 13->26         started        28 Windows Support.exe 15->28         started        30 Windows Support.exe 17->30         started        signatures5 process6 signatures7 32 Runtime Broker.exe 4 19->32         started        67 Multi AV Scanner detection for dropped file 21->67 36 WerFault.exe 20 9 21->36         started        process8 dnsIp9 51 uogapk3.ddns.net 32->51 43 C:\Users\user\AppData\...\Windows Support.exe, PE32 32->43 dropped 38 Windows Support.exe 3 32->38         started        file10 process11 process12 40 Windows Support.exe 1 4 38->40         started        dnsIp13 53 uogapk7.ddns.net 101.53.240.61, 2222 CYBERNET-APCyberInternetServicesPvtLtdPK Pakistan 40->53 55 uogapk17.ddns.net 105.190.59.121, 2222, 49755 ASMediMA Morocco 40->55 57 13 other IPs or domains 40->57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 03:06:02 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5o5s6b646nhbf7upqbdafoapr3nlopfkyrwf6suzqulf56rorfa._file
Verdict:
suspicious
Similar samples:
041130786cac4dbd0a0444fd33829f9186b7ff402831358689d5f364a84379a5
RevengeRAT
0b4ccd794d4c74c73f78eecf5bd9057fb7ab1d558aab5937b6cf7aa52d53373f
RevengeRAT
7af6be720f63c86de10443745e332a5717aa9b14fa3e8ecca584ef370f2080da
RevengeRAT
cf97a857487977e743493a3d8d077d3caed20300a86da16dd375de614fbe5e7f
RevengeRAT
d74f9f54c19ff7ec1301b84bc72ee2b143c94db7b56c88b4c660cb7abcd7b513
RevengeRAT
e0287568096f94034a8746adef8f4c08db4ef5f51134f90740b1c72eb1b1eb0b
RevengeRAT
e44ea6095036b15910c82941c0c3af5178687d3deeb9954adf9967cd833b9349
RevengeRAT
e72478765908b84f150ef0b7e895cfca0780a9107de6cf819ec5715f6f179acd
RevengeRAT
ed5c6f06e459285fa5e621026be965558add0841e7426ecee6d3e41d5e9b9761
RevengeRAT
fe614080646708a020532d8dac57d96767d07ac9f605e86ba306dbfd8f9d51cf
RevengeRAT
+ 71 additional samples on MalwareBazaar
Result
Malware family:
revengerat
Create hunting rule
Score:
  10/10
Tags:
family:revengerat persistence stealer trojan
Link:
https://tria.ge/reports/210620-lfzgvxq2l2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Adds Run key to start application
Drops startup file
Loads dropped DLL
Executes dropped EXE
RevengeRat Executable
RevengeRAT
Unpacked files
SH256 hash:
d19d4113ce1adb4b5489ecfd6b879dee9b425e00410d17b7217aefc0d5c64ace
MD5 hash:
735833828bc759e336055d277f2d97e3
SHA1 hash:
f5ba80b8557ef1ec388c8acee55966afe33d68be
Link:
https://www.unpac.me/results/ff34c73d-574c-4906-b61c-1c797648aaee/
SH256 hash:
97175f1d7542a2e900eb543737d46216d3269179b13a02758d3147978a2a5772
MD5 hash:
d3659ff48ce9e369bbbff0f878609d99
SHA1 hash:
9232625cdcf786415bbda8fc5d9f057538e076d9
Link:
https://www.unpac.me/results/ff34c73d-574c-4906-b61c-1c797648aaee/
SH256 hash:
096221ed42b40428c6d6ef6e4c136d2cafb9158e99660a1783c5ee5bd662144f
MD5 hash:
35aa8e34dc51fdf03f82fb8b4e21dc4c
SHA1 hash:
26b8fb7d531fd3312ed3629b4568dfdb397ec84f
Link:
https://www.unpac.me/results/ff34c73d-574c-4906-b61c-1c797648aaee/
SH256 hash:
5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a
MD5 hash:
385b9916d255f7b6e411e39f6cab3623
SHA1 hash:
9891f98372ad8b7f85abc5e9399726496dbe203a
Link:
https://www.unpac.me/results/ff34c73d-574c-4906-b61c-1c797648aaee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.85
Link:
https://yomi.yoroi.company/submissions/5f5dd9783ee79a7097f47c023015c07c76d5b9e5562362fa54cc28b2f7d1744a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Glasses
Create hunting rule
Author:Seth Hardy
Description:Glasses family
Rule name:GlassesCode
Create hunting rule
Author:Seth Hardy
Description:Glasses code features
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/167207/

Comments