MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd
SHA3-384 hash: 261e2904069a23394ebae0457555c91e9b71226e9e8cebad4b0ce52089765cd3cc93803a91ae3a7ab291c8ce57ef413e
SHA1 hash: f579ae533109afddd4d9e528c7c393035cd80e7a
MD5 hash: 5508be73f4288131312fe9dcbe64322c
humanhash: robin-london-golf-fix
File name:213124dados cancelar a reserva.js
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:61'916 bytes
First seen:2024-10-15 19:45:46 UTC
Last seen:Never
File type:Java Script (JS) js
MIME type:text/plain
ssdeep 768:qze48RhtXFS/81q/y1wGU8a1aIIEHU8aIIFTTV+i2jsm888esI8X88888gKV7+lA:qC48xhtaGcdIh8aIIxgFv
Threatray 135 similar samples on MalwareBazaar
TLSH T1B7538738FB7454639E1E2F1762CD44BBB9703C8BE148C69B9180E9AFD78667C6960331
Magika javascript
Reporter abuse_ch
Tags:js RevengeRAT


Avatar
abuse_ch
RevengeRAT C2:
54.146.241.16:5222

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
54.146.241.16:5222 https://threatfox.abuse.ch/ioc/1336644/

Intelligence

File Origin
# of uploads :
1
# of downloads :
427
Origin country :
NL NL
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.JS.Obfus-2179.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PUA.JS.Obfus-2525.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=670ec67b1d4ef219fa631034
Tags:
Powershell Autorun Gumen
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
obfuscated persistence powershell
Link:
https://www.filescan.io/uploads/670ec67b286e8761104d3c3f/reports/cad60d52-d167-4875-a7dd-dfe5ec025363/overview
Verdict:
Malicious
Labled as:
SVM:TrojanDownloader/JS.Nemucod
Link:
https://www.hybrid-analysis.com/sample/d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd
Result
Threat name:
RevengeRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1534446
Signature
Bypasses PowerShell execution policy
Creates autostart registry keys with suspicious values (likely registry only malware)
Drops script or batch files to the startup folder
JavaScript source code contains functionality to generate code involving a shell, file or stream
JScript performs obfuscated calls to suspicious functions
Potential obfuscated javascript found
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Drops script at startup location
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Set autostart key via New-ItemProperty Cmdlet
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
Yara detected RevengeRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1534446 Sample: 213124dados cancelar a reserva.js Startdate: 15/10/2024 Architecture: WINDOWS Score: 100 88 Suricata IDS alerts for network traffic 2->88 90 Yara detected RevengeRAT 2->90 92 Sigma detected: Set autostart key via New-ItemProperty Cmdlet 2->92 94 7 other signatures 2->94 9 wscript.exe 1 1 2->9         started        12 wscript.exe 1 2->12         started        14 wscript.exe 1 2->14         started        16 wscript.exe 2->16         started        process3 signatures4 104 JScript performs obfuscated calls to suspicious functions 9->104 106 Suspicious powershell command line found 9->106 108 Wscript starts Powershell (via cmd or directly) 9->108 110 3 other signatures 9->110 18 powershell.exe 29 9->18         started        22 powershell.exe 12->22         started        24 powershell.exe 14->24         started        26 powershell.exe 14->26         started        28 powershell.exe 14->28         started        30 powershell.exe 16->30         started        32 powershell.exe 16->32         started        34 powershell.exe 16->34         started        process5 file6 82 C:\...\213124dados cancelar a reserva.js, ASCII 18->82 dropped 96 Drops script or batch files to the startup folder 18->96 36 wscript.exe 1 1 18->36         started        39 conhost.exe 18->39         started        53 2 other processes 22->53 41 conhost.exe 24->41         started        43 conhost.exe 26->43         started        45 conhost.exe 28->45         started        47 conhost.exe 30->47         started        49 conhost.exe 32->49         started        51 conhost.exe 34->51         started        signatures7 process8 signatures9 98 Suspicious powershell command line found 36->98 100 Wscript starts Powershell (via cmd or directly) 36->100 55 powershell.exe 1 27 36->55         started        58 powershell.exe 27 36->58         started        61 powershell.exe 24 36->61         started        64 powershell.exe 53->64         started        66 powershell.exe 53->66         started        68 powershell.exe 53->68         started        process10 dnsIp11 102 Creates autostart registry keys with suspicious values (likely registry only malware) 55->102 70 conhost.exe 55->70         started        86 54.146.241.16, 49736, 5222 AMAZON-AESUS United States 58->86 72 conhost.exe 58->72         started        84 C:\...\213124dados cancelar a reserva.js, ASCII 61->84 dropped 74 conhost.exe 61->74         started        76 conhost.exe 64->76         started        78 conhost.exe 66->78         started        80 conhost.exe 68->80         started        file12 signatures13 process14
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ij6i5rmxr4aa7m7iwuff2sjqjs2rpimeqwjhmr6mjhtalqftxoq._file
Verdict:
malicious
Label(s):
revengerat
Create hunting rule
Similar samples:
0cf1fb98bec224f1b5060c40c4784e5a43b022e2ce105b920bca786a92d153c3
RevengeRAT
11300e64a1fb9cb221dc0bfc9d0db96a43a307033b4d9cd9ba014a722b1ec882
RevengeRAT
213857b03db27acb0cb52357799ba8f3ce4adb843e66ddc35bf8949d10ebd61a
RevengeRAT
33c8fe22df4820837ad45f4913a1246ab27cae4353b86ae16eed50b60bb752ec
RevengeRAT
562362c52e398b4d28dd90a6b5b127311ff2fd8ae3029ef68ccdccbe63215c9d
RevengeRAT
d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd
RevengeRAT
error
RevengeRAT
f89e0e38e38cd6df4720703d2b8b3d2217b25a60e845ec6bbd4a4a45919babb7
RevengeRAT
+ 125 additional samples on MalwareBazaar
Result
Malware family:
revengerat
Create hunting rule
Score:
  10/10
Tags:
family:revengerat botnet:nyancatrevenge execution persistence trojan
Link:
https://tria.ge/reports/241015-ygyhfsxfnl/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Command and Scripting Interpreter: JavaScript
Enumerates physical storage devices
Adds Run key to start application
Checks computer location settings
Drops startup file
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
RevengeRAT
Malware Config
C2 Extraction:
54.146.241.16:5222
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d213e4762cbc78007d9f45a852ea498265a8bd0c242c93b23e624f302e059ddd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:SUSP_obfuscated_JS_obfuscatorio
Create hunting rule
Author:@imp0rtp3
Description:Detect JS obfuscation done by the js obfuscator (often malicious)
Reference:https://obfuscator.io

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments