MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c656d7d18181d06dc4ffa7a0477f44c5ba4e891c18bb66ba31f8f8ddba22f742. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c656d7d18181d06dc4ffa7a0477f44c5ba4e891c18bb66ba31f8f8ddba22f742
SHA3-384 hash: bc23cc4a63533c9fcd2d90fa91ec1a9e7d426b526d01de46dd784b4f75af73491bef12497246d7dd1c5478d690a49f4a
SHA1 hash: 0e4d2d777d211f5ec9d04d93ece0795aaffa5876
MD5 hash: 2b533f48064f0946d45115ad38c0749e
humanhash: comet-maryland-california-september
File name:c656d7d18181d06dc4ffa7a0477f44c5ba4e891c18bb66ba31f8f8ddba22f742
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:145'408 bytes
First seen:2020-06-16 09:41:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:Bm+ODql11tv13Njveowk9M1JFofonCciRpxZuNgd6MnBnXeaCrfNG9WPT83qzJfz:kCY1JqQn07d1n9CzQ9gT83qzTxt8+
Threatray 31 similar samples on MalwareBazaar
TLSH 76E35C2AB74BCF23C96C0AB850E7351857B463536B33D74A6EDD20ED7A933421E0658E
Reporter JAMESWT_WT
Tags:RevengeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
418
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10833/
Detection(s):
Win.Trojan.Generic-6332612-0
Create hunting rule

Win.Malware.Razy-6862379-0
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Downloader.EncDoc
Create hunting rule
Status:
Malicious
First seen:
2020-06-12 12:39:10 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
27 of 31 (87.10%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzlnpumbqhig3rh7u6qeo72eyw5e5ci4dc5wnorr7d4n3orc65ba._file
Verdict:
suspicious
Similar samples:
03f5db6aa8252bf8ffaaf6a9e843567ba4bf228bd3309449b16e03e303fd7c12
RevengeRAT
0ed07cd100c933c766b2183c8c46f913116bc89b2651e22c3dd5a61c06913b7a
RevengeRAT
1ff495dacc5d548ac9899ec1622b0408b9948ac485f0f7d782d2a3cabe94e2b8
RevengeRAT
284f5d7c77eab431e6dd8bdd9e508bbd1e2e3dc467b40f68b834b1a437061061
RevengeRAT
5c95e5c1b2b58307ed81c9abb6aac3174de94577c560ccf4b9d0881922539069
RevengeRAT
5fa3c8bbf60b41b010f4a98e17fd0ee4630a6e365049279d72e4849374964101
RevengeRAT
829abf5ae6cc64c2099d4e8f5160877ee47f82d9d8c29f24b47cee0aad726986
RevengeRAT
9ed8b4aa4693089d71da648dcc5a33cb2263d82cd522140e063d3150747a2f6d
RevengeRAT
b9f3224ab5b74db881ce36d3177812635ee6accae03a86c5beec94c095eaa105
RevengeRAT
e939047540fd58d605f6e259e9be2e2370f51e79246b34c2d01acc94cb19b4dc
RevengeRAT
+ 21 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
persistence
Link:
https://tria.ge/reports/200624-mzmsej7bfs/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Adds Run entry to start application
Loads dropped DLL
Uses the VBS compiler for execution
Drops startup file
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RevengeRAT_Sep17
Create hunting rule
Author:Florian Roth
Description:Detects RevengeRAT malware
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10833/

Comments