Procedure examples

Revenge RAT has a plugin for credential harvesting.

Revenge RAT collects the IP address and MAC address from the system.

Revenge RAT has a plugin to perform RDP access.

Revenge RAT gathers the username from the system.

Revenge RAT schedules tasks to run malicious scripts at different intervals.

Revenge RAT has a plugin for keylogging.

Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.

Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.

Revenge RAT collects the CPU information, OS information, and system language.

Revenge RAT used blogpost.com as its primary command and control server during a campaign.

Revenge RAT has the ability to upload and download files.

Revenge RAT has a plugin for screen capture.

Revenge RAT has a plugin for microphone interception.

Revenge RAT has the ability to access the webcam.

Revenge RAT uses Base64 to encode information sent to the C2 server.

Revenge RAT uses the Forfiles utility to execute commands on the system.

Revenge RAT uses mshta.exe to run malicious scripts on the system.

Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.