MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edcf2ab0937689a7e0475395a8654f874e413649ee63100e61c4d1a8c09ba681. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RevengeRAT


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edcf2ab0937689a7e0475395a8654f874e413649ee63100e61c4d1a8c09ba681
SHA3-384 hash: 371748eeb3e538a44e58ebceb2f331dab627b93d7f99b0a6d20c203418715e1f92427df65bb32881fcd88ed4a43e7616
SHA1 hash: 50e788ab20062ee1b4d529d64feb94be6a2b3b34
MD5 hash: dc7364b3378a9faadd3740fee4ead768
humanhash: kitten-indigo-twenty-nuts
File name:edcf2ab0937689a7e0475395a8654f874e413649ee63100e61c4d1a8c09ba681
Download: download sample
Signature RevengeRAT
Create hunting rule
File size:51'712 bytes
First seen:2020-07-07 06:46:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 768:U6HAzolOKAMfrqoRB7lbry77p1ap2qLq/ZPS0jJ2T:9AElkMfrqYB7lbu77jyzW/hn
Threatray 98 similar samples on MalwareBazaar
TLSH 8633B643B7878712D85C15B950EB252413F09FCB5333D54B2E9C71AEAA33393AE85AC9
Reporter JAMESWT_WT
Tags:remcos RevengeRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
461
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/21867/
Detection(s):
Win.Trojan.RevengeRAT-6690354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edcf2ab0937689a7e0475395a8654f874e413649ee63100e61c4d1a8c09ba681/
Threat name:
ByteCode-MSIL.Trojan.Revetrat
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 06:48:05 UTC
File Type:
PE (Exe)
AV detection:
40 of 48 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5xhsvmeto2e2pychkok2qzkpq5hecnsj5zrradtbyti2rqe3u2aq._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
3764a8690d829b849cc82babfb6dc75a3b6f812e46d3d9535c380c187534094e
RevengeRAT
460cca0f6a1acc665e76da5539844db4fd042761cbe9641a2b9fb663a322a3ab
RevengeRAT
7af6be720f63c86de10443745e332a5717aa9b14fa3e8ecca584ef370f2080da
RevengeRAT
a324263f8734bb62ba035022d5533419994482ccd63f8adbf717ae52a9c2e6e1
RevengeRAT
d74f9f54c19ff7ec1301b84bc72ee2b143c94db7b56c88b4c660cb7abcd7b513
RevengeRAT
d85497f61b07d8f8cc30c3c66ab21883a0274c7a3e7bc982a3a622ca2eed39a4
RevengeRAT
e0287568096f94034a8746adef8f4c08db4ef5f51134f90740b1c72eb1b1eb0b
RevengeRAT
e44ea6095036b15910c82941c0c3af5178687d3deeb9954adf9967cd833b9349
RevengeRAT
e72478765908b84f150ef0b7e895cfca0780a9107de6cf819ec5715f6f179acd
RevengeRAT
ed5c6f06e459285fa5e621026be965558add0841e7426ecee6d3e41d5e9b9761
RevengeRAT
+ 88 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/200707-ss3amg9h6a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RevengeRAT_Sep17
Create hunting rule
Author:Florian Roth
Description:Detects RevengeRAT malware
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
X
https://twitter.com/pmelson/status/1280322293965688832?s=20
Cape
Cape
https://www.capesandbox.com/analysis/21867/

Comments