Tuesday, May 6, 2025
HomeCyber Security NewsFileless Revenge RAT Abuses Legitimate Tools to Hide Malicious Activity

Fileless Revenge RAT Abuses Legitimate Tools to Hide Malicious Activity

Published on

SIEM as a Service

Follow Us on Google News

Threat actors are distributing Revenge RAT malware, developed using legitimate tools like “smtp-validator” and “Email to SMS.”

When executed, the malware runs a malicious file and a legitimate tool, making it difficult for users to know there is malicious activity.

Moreover, threat actors have also created a setup.exe file that is executed and hidden before the execution of smtp-verifier.exe. In addition, several files are used in this Revenge RAT malware execution process.

- Advertisement - Google News
Document
Live Account Takeover Attack Simulation

How do Hackers Bypass 2FA?

Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks .

Revenge RAT Abuses Legitimate Tools

According to the reports shared with Cyber Security News, the malicious file “setup.exe” is used for generating additional malware by creating and running svchost.exe in the %appdata%Microsoft\Windows\Templates path with a hidden attribute.

Revenge RAT Malware flow (Source: AhnLab)
Revenge RAT Malware flow (Source: AhnLab)

After this, the svchost.exe file is registered in the autorun registry by the setup.exe file with the value “Microsoft Corporation Security.” The svchost.exe file connects to the C2 server and downloads the HTML file, which is then decompressed.

The downloaded HTML file creates and runs the explorer.exe file in the %appdata%Microsoft\Windows\Templates path. There were 2 C2 servers mentioned as an alternate solution in case the first C2 server URL was blocked or when a new C2 was updated.

C2 with binary disguided (Source: AhnLab)
C2 with binary disguided (Source: AhnLab)

This new explorer.exe file creates another file with the name version.exe in the %appdata%Microsoft\Windows\ path and a .inf file in the %temp% path. This version.exe file is executed with an argument to cmstp.exe (CMSTP defense evasion). Finally, the Revenge RAT is run as fileless malware.

To further prevent disruption of the malware activity, version.exe is designed to run a PowerShell command that adds the files used by the Revenge RAT malware as an exception list in the Windows Defender.

ASEC provides detailed information on the malware, source code, file execution, etc.

Indicators of Compromise

File Detection

  • Trojan/Win.Generic.C4223332
  • Trojan/Win.Generic.C5583117
  • Dropper/Win.Generic.C5445718
  • Dropper/Win.Generic.R634030
  • Backdoor/Win.REVENGERAT.C5582863
  • Backdoor/Win.REVENGERAT.R634026

MD5

  • 42779ab18cf6367e7b91e621646237d1 (smtp-verifier.exe)
  • fb34fe9591ea3074f048feb5b515eb61 (Email To Sms V8.1.exe)
  • 6d5ad2adce366350200958c37f08a994 (setup.exe)
  • 914ec5019485543bb2ec8edcacd662a7 (setup.exe)
  • 5e24e97bbc8354e13ee3ab70da2f3af6 (svchost.exe)
  • 1242c41211464efab297bfa6c374223e (svchost.exe)
  • 438817d3938ae5758d94bf2022a44505 (explorer.exe)
  • 304e264473717fad8f7c6970212eaaa7 (version.exe)
  • d1af87e121d55230353cbad9b7024fae (Fileless RevengeRAT)
  • 6e22b450a765caa999ca984521b42242 (g1rfp0hb.inf)

C&C

  • qcpanel.hackcrack[.]io:9561

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Cybersecurity researcher has uncovered a massive malware campaign targeting MacOS users through approximately 2,800...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

BFDOOR Malware Targets Organizations to Establish Long-Term Persistence

The BPFDoor malware has emerged as a significant threat targeting domestic and international organizations,...

Uncovering the Security Risks of Data Exposure in AI-Powered Tools like Snowflake’s CORTEX

As artificial intelligence continues to reshape the technological landscape, tools like Snowflake’s CORTEX Search...

UNC3944 Hackers Shift from SIM Swapping to Ransomware and Data Extortion

UNC3944, a financially-motivated threat actor also linked to the group known as Scattered Spider,...