RevengeRAT.exe

Classification: Malicious

RevengeRAT.exe is a trojan (Windows executable, 4.0 MB). Flagged by 80% of antivirus engines (82 detections). Linked to Revenge Rat malware.

Detection summary

  • 82 antivirus detections (80% detection ratio)
  • 0 IDS alerts
  • 42 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: REVENGE RAT (S0379)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Revengerat Triage 2026-03-31 10:28:57 2026-10-16 02:13:00 malicious-activity S0379 Revenge RAT
Generic Malware Cyber Threat Alliance 2026-09-24 10:11:39 2026-09-25 10:24:03 malicious-activity
Generic Malware Hybrid-Analysis 2023-07-15 11:15:04 2025-01-08 19:31:47

Tags

evasive windows-server-utility revengerat guest discovery stealer trojan defense_evasion execution persistence privilege_escalation

Sample information

Filenames
RevengeRAT.exe
File type
PE32 executable (GUI) Intel 80386 Mono/.Net assemb ...
Size
4194304 bytes
MD5
1d9045870dbd31e2e399a4e8ecd9302f
SHA-1
7857c1ebfd1b37756d106027ed03121d8e7887cf
SHA-256
9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885
First indexed
2023-07-15 10:42:42
Last updated
2026-09-26 06:07:18

Antivirus detections

EngineDetection
LionicTrojan.Win32.RRAT.4!c
MicroWorld-eScanIL:Trojan.MSILMamut.3955
ClamAVWin.Trojan.RevengeRat-6344273-0
CAT-QuickHealTrojan.RratFC.S17035669
McAfeeReventRat!1D9045870DBD
CylanceUnsafe
ZillyaTrojan.Agent.Win32.1742104
SangforSuspicious.Win32.Save.a
K7AntiVirusTrojan ( 700000121 )
AlibabaBackdoor:MSIL/RevengeRat.59d4caec
K7GWTrojan ( 700000121 )
Cybereasonmalicious.70dbd3
ArcabitIL:Trojan.MSILMamut.DF73
CyrenW32/Revetrat.A.gen!Eldorado
SymantecTrojan.Revetrat
ElasticWindows.Trojan.Revengerat
ESET-NOD32a variant of MSIL/Agent.APN
APEXMalicious
Paloaltogeneric.ml
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.RRAT.gen
BitDefenderIL:Trojan.MSILMamut.3955
TencentWin32.Trojan.Rrat.Qnkl
EmsisoftIL:Trojan.MSILMamut.3955 (B)
F-SecureTrojan.TR/Dropper.Gen
DrWebBackDoor.RevetratNET.1
VIPREIL:Trojan.MSILMamut.3955
TrendMicroTROJ_REVETRAT.SM
McAfee-GW-EditionReventRat!1D9045870DBD
Trapminemalicious.moderate.ml.score
FireEyeGeneric.mg.1d9045870dbd31e2
SophosMal/Revet-A
IkarusBackdoor-Rat.Revenge
JiangminTrojan.RRAT.alc
WebrootW32.Trojan.RevengeRat
AviraTR/Dropper.Gen
MAXmalware (ai score=100)
Antiy-AVLTrojan/Win32.RRAT
XcitiumMalware@#1vinton0ottbm
MicrosoftBackdoor:MSIL/RevengeRat.GA!MTB
GDataIL:Trojan.MSILMamut.3955
GoogleDetected
AhnLab-V3Trojan/Win32.RL_Generic.C3448952
Acronissuspicious
BitDefenderThetaGen:NN.ZemsilF.36252.@lZ@aik4Cai
ALYacIL:Trojan.MSILMamut.3955
VBA32Dropper.MSIL.gen
MalwarebytesGeneric.Trojan.MSIL.DDS
PandaTrj/CI.A
TrendMicro-HouseCallTROJ_REVETRAT.SM
RisingBackdoor.Revetrat!1.B8DA (CLASSIC)
SentinelOneStatic AI - Malicious PE
MaxSecureTrojan.Malware.74238462.susgen
FortinetMSIL/RevengeRat.APN!tr
AVGWin32:RATX-gen [Trj]
AvastWin32:RATX-gen [Trj]
AVGWin32:MalwareX-gen [Rat]
AlibabaBackdoor:MSIL/RevengeRat.83183e9a
ArcabitGen:MSIL.Heur2.Lagos.2
AvastWin32:MalwareX-gen [Rat]
BitDefenderGen:MSIL.Heur2.Lagos.2
BkavW32.AIDetectMalware.CS
CTXexe.trojan.msil
CrowdStrikewin/malicious_confidence_100% (W)
DeepInstinctMALICIOUS
EmsisoftGen:MSIL.Heur2.Lagos.2 (B)
GDataGen:MSIL.Heur2.Lagos.2
IkarusTrojan.MSIL.Agent
KingsoftWin32.Trojan.RRAT.gen
McAfeeDReal Protect-LS!1D9045870DBD
MicroWorld-eScanGen:MSIL.Heur2.Lagos.2
SkyhighReventRat!1D9045870DBD
TencentMalware.Win32.Gencirc.149629a4
TrellixENSReventRat!1D9045870DBD
VIPREGen:MSIL.Heur2.Lagos.2
VaristW32/Revetrat.A.gen!Eldorado
ViRobotTrojan.Win.Z.Rrat.4194304
VirITTrojan.Win32.MSIL_Heur.A
YandexTrojan.Agent!UGf3uD3GlFM
ZoneAlarmMal/Revet-A
alibabacloudBackdoor[rat]:MSIL/RevengeRAT
huorongTrojan/MSIL.Injector.fj

Process list

NameCommand line
RevengeRAT.exe
fondue.exe/enable-feature:NetFx3 /caller-name:mscoreei.dll
OptionalFeatures.EXE/enable-feature:NetFx3 /caller-name:mscoreei.dll
RevengeRAT.exe
RegSvcs.exe
RegSvcs.exe
svchost.exe
RegSvcs.exe
RegSvcs.exe
schtasks.exeschtasks /create /sc minute /mo 1 /tn "svchost" /tr "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
vbc.exe/noconfig @"%TEMP%\nty9oubh.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES412D.tmp" "%TEMP%\vbc4071.tmp"
vbc.exe/noconfig @"%TEMP%\6qizt3cx.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES53BB.tmp" "%TEMP%\vbc533D.tmp"
vbc.exe/noconfig @"%TEMP%\9vijoe74.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8153.tmp" "%TEMP%\vbc8087.tmp"
RegSvcs.exe
RegSvcs.exe
vbc.exe/noconfig @"%TEMP%\mhu8tq0r.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES8FAB.tmp" "%TEMP%\vbc8DD5.tmp"
vbc.exe/noconfig @"%TEMP%\zny-ko1r.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESB227.tmp" "%TEMP%\vbcB0FD.tmp"
vbc.exe/noconfig @"%TEMP%\veooxvng.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESD213.tmp" "%TEMP%\vbcCFA1.tmp"
vbc.exe/noconfig @"%TEMP%\ej0q7lut.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESE79F.tmp" "%TEMP%\vbcE4B0.tmp"
vbc.exe/noconfig @"%TEMP%\wojrkloj.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RESFCAD.tmp" "%TEMP%\vbcFC3F.tmp"
vbc.exe/noconfig @"%TEMP%\9iucwg2h.cmdline"
cvtres.exe/NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES1C2C.tmp" "%TEMP%\vbc1B21.tmp"