Cylance Shaheen Nov 2018

Revenge RAT has a plugin for credential harvesting.

Revenge RAT collects the IP address and MAC address from the system.

Revenge RAT has a plugin to perform RDP access.

The White Company has obfuscated their payloads through packing.

Revenge RAT gathers the username from the system.

Revenge RAT has a plugin for keylogging.

The White Company has the ability to delete its malware entirely from the target system.

Revenge RAT collects the CPU information, OS information, and system language.

Revenge RAT has the ability to upload and download files.

Revenge RAT has a plugin for screen capture.

Revenge RAT has a plugin for microphone interception.

The White Company has checked the current date on the victim system.

Revenge RAT has the ability to access the webcam.

Revenge RAT uses Base64 to encode information sent to the C2 server.

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.

The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.

Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.