MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fa7ec5a17354bfeb41773b2d6e52acd2ba9182d932ae5080e992542e207020d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fa7ec5a17354bfeb41773b2d6e52acd2ba9182d932ae5080e992542e207020d
SHA3-384 hash: 018da898fca276e8455f5d68b7162ad4ad106fa6ce6a5d318c54ef225e17601223557f8f543457c14c9121ba793c1c4f
SHA1 hash: a8a93ad6361b01eaf1f1edfb7e688c2349ae723d
MD5 hash: a82d65c01157eafb493ac2fa6bff9cd6
humanhash: tango-queen-twenty-bravo
File name:GOV Cancelamento.zip
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:48'106 bytes
First seen:2020-05-20 17:57:16 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 768:4KwqrHXNRI1/wbBc6ohf+ldq8l5CyVe4yqyDJbgftQPZPTvfqE1TudrGUmNasSVz:4zAXxbBc9hWLdVepiQPlTvSE1IyUmNaz
TLSH 8023F14BE59DFCE3D75821235CE3D2C25EA70EC33CA8C93481D531AB85E3F1685A588A
Reporter abuse_ch
Tags:RevengeRAT zip


Avatar
abuse_ch
Malspam distributing RevengeRAT:

HELO: smtp245t7f134.saaspmta0002.correio.biz
Sending IP: 179.188.7.134
From: "Cesar Kruger" <csrkruger@gmail.com>
Reply-To: csrkruger@gmail.com
Subject: Solicitação de reserva número 104987
Attachment: GOV Cancelamento.zip (contains "GOV Cancelamento.exe")

RevengeRAT C2:
covid19mefudeu.duckdns.org:333 (35.188.143.158)

Intelligence

File Origin
# of uploads :
1
# of downloads :
414
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader25.50718.22221.14445.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 15:50:56 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l6t6ywqxgvf75naxooznnzjkzuv2sgbnsmvokcaotesufyqhaigq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RevengeRAT

zip 5fa7ec5a17354bfeb41773b2d6e52acd2ba9182d932ae5080e992542e207020d

(this sample)

RevengeRAT

Executable exe 6a0de88e3ae5889cd121145fed3dee8412151c47aa5d119ddf0b603a41e21d15

  
Dropping
MD5 adfe50f334781a6b05dc8722e56d7e6e
  
Dropping
RevengeRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6a0de88e3ae5889cd121145fed3dee8412151c47aa5d119ddf0b603a41e21d15

Comments