MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc
SHA3-384 hash: 26a061a45e7719db5a561d9c8c490ecdc3e05497e95802892b5693f4708cf0d5956118f035304e7f5bceadf0661d51ef
SHA1 hash: d384688b3e66051345a00a97063310976f800133
MD5 hash: c83513923776a7d64badd645aed5077f
humanhash: georgia-high-massachusetts-happy
File name:ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:247'296 bytes
First seen:2020-06-29 07:30:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 6144:BCRB2K4mOPwcb4Y97wiwxDgHtNZJrlHOXoxpnl:Pljt97nwxDgNNZXHOY7l
Threatray 163 similar samples on MalwareBazaar
TLSH 9E34F187B29BDC45D76D077690E1546C82B3690366C2E63B7CED2BC608B5BCC79122CB
Reporter JAMESWT_WT
Tags:RevengeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
420
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/15678/
Detection(s):
Win.Packed.Hpbladabi-6860330-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6391397-0
Create hunting rule

PUA.Win.Packed.ConfuserEx-6582917-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad0faaddf940dee1a7bb669d39d53a6c0564f1cb3d852a4f19f324394ca997dc/
Threat name:
ByteCode-MSIL.Trojan.BitCoin
Create hunting rule
Status:
Malicious
First seen:
2020-06-25 18:28:00 UTC
File Type:
PE (.Net Exe)
AV detection:
35 of 48 (72.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vuh2vxpzidpodj53m2ottvj2nqcwj4olhwcsutyz6msdstfjs7oa._file
Verdict:
unknown
Similar samples:
3e30d9e15ee915170a4823f8a603376b1c77de63199c635bceaa086072358a8f
RevengeRAT
416be48f063784dfa696921edc4844d902cd88d354f45184e5d23d70db94895f
RevengeRAT
44aed13625d865c6ec22abde70f0f3205017d699f54c921b138c325daf4fe5a8
RevengeRAT
5bcbbf82aa7c1bde8cddd6a6d50b4b082555ddb0dd23dd468ef238850238ed2a
RevengeRAT
a654772e801683ef8639985af05c8845d16ab48df5c6a8e65d014251692d73d2
RevengeRAT
d4279c465a54afb5b1a9f32f87f5b2508c2e1730d7e98febed526af63c6dd24f
RevengeRAT
d4e04e3e99ee2e4ff9ebb41ed1e8d19e1d0f59f297f0ef6e72946ad466eb863d
RevengeRAT
f1ce8a3c72d7e45300b38de923c0ad45c466ef17a44bec4aad85a4672690eb22
RevengeRAT
fb3ca1866e216ffad74344e564be2f8aacabeb2c4616113d9fddf11561096bb6
RevengeRAT
fc89e8d722a8625e80e22f5a19ef1371e388e1583e55618f2ea2451dfe356845
RevengeRAT
+ 153 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200629-jb2v1njx3x/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run entry to start application
Uses the VBS compiler for execution
Drops startup file
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RevengeRAT_Sep17
Create hunting rule
Author:Florian Roth
Description:Detects RevengeRAT malware
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15678/

Comments