Threat actors are distributing Revenge RAT malware, developed using legitimate tools like “smtp-validator” and “Email to SMS.”
When executed, the malware runs a malicious file and a legitimate tool, making it difficult for users to know there is malicious activity.
Moreover, threat actors have also created a setup.exe file that is executed and hidden before the execution of smtp-verifier.exe. In addition, several files are used in this Revenge RAT malware execution process.
Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks .
According to the reports shared with Cyber Security News, the malicious file “setup.exe” is used for generating additional malware by creating and running svchost.exe in the %appdata%Microsoft\Windows\Templates path with a hidden attribute.
After this, the svchost.exe file is registered in the autorun registry by the setup.exe file with the value “Microsoft Corporation Security.” The svchost.exe file connects to the C2 server and downloads the HTML file, which is then decompressed.
The downloaded HTML file creates and runs the explorer.exe file in the %appdata%Microsoft\Windows\Templates path. There were 2 C2 servers mentioned as an alternate solution in case the first C2 server URL was blocked or when a new C2 was updated.
This new explorer.exe file creates another file with the name version.exe in the %appdata%Microsoft\Windows\ path and a .inf file in the %temp% path. This version.exe file is executed with an argument to cmstp.exe (CMSTP defense evasion). Finally, the Revenge RAT is run as fileless malware.
To further prevent disruption of the malware activity, version.exe is designed to run a PowerShell command that adds the files used by the Revenge RAT malware as an exception list in the Windows Defender.
ASEC provides detailed information on the malware, source code, file execution, etc.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
Cybersecurity researcher "0xdf" has cracked the "Ghost" challenge on Hack The Box (HTB), a premier…
Google has unveiled Sec-Gemini v1, an AI model designed to redefine cybersecurity operations by empowering…
The United States has successfully extradited two Kosovo nationals, Ardit Kutleshi, 26, and Jetmir Kutleshi,…
Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…
A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…
EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…