Threat Database Trojans Trojan.Revenge-RAT

Trojan.Revenge-RAT

By CagedTech in Trojans
Published:
Last updated:

Threat Scorecard

Popularity Rank: 20,789
Threat Level: 80 % (High)
Infected Computers: 2,099
First Seen: April 5, 2013
Last Seen: July 14, 2026
OS(es) Affected: Windows

The detection of Trojan.Revenge-RAT on your system indicates a potential security threat that requires immediate attention. This type of malware is designed to compromise the security and integrity of your computer, allowing unauthorized access and control. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.

What Is Trojan.Revenge-RAT?

Trojan.Revenge-RAT is a type of Trojan horse malware, which is a broad category of malicious software that disguises itself as legitimate programs. The name "Trojan" refers to the malware's ability to deceive users into installing it voluntarily, often by masquerading as a useful application or software update. The "RAT" suffix suggests that this particular malware may have remote access capabilities, allowing attackers to control infected systems from a distance.

How Trojan.Revenge-RAT Operates

Once installed, Trojan.Revenge-RAT can operate in various ways, depending on its intended purpose and the goals of its creators. It may attempt to gather sensitive information, such as login credentials, credit card numbers, or personal data, which can be used for identity theft, financial fraud, or other malicious activities. The malware may also install additional malicious components, create backdoors for remote access, or disrupt system operation to extort money from the victim.

Trojan.Revenge-RAT can spread through various means, including infected software downloads, compromised websites, phishing emails, or infected USB drives. It may exploit vulnerabilities in operating systems, applications, or plugins to gain unauthorized access to the system.

Symptoms of Infection

Systems infected with Trojan.Revenge-RAT may exhibit a range of symptoms, including unusual network activity, slow system performance, frequent crashes, or unfamiliar programs running in the background. You may also notice suspicious pop-ups, unexpected changes to system settings, or unauthorized access to sensitive data. However, some infections may remain asymptomatic, making it difficult to detect the malware without proper scanning tools.

  • Unexplained changes to system settings or configuration
  • Appearance of unfamiliar programs or icons
  • Increased network activity or unusual traffic patterns
  • Slow system performance or frequent crashes
  • Suspicious pop-ups or alerts

How to Remove Trojan.Revenge-RAT

  1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for internet access.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of the malware.
  3. Uninstall any suspicious programs or applications that may be related to the infection.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
  5. Reboot your system and perform another full scan to ensure that all remnants of the malware have been removed.

Conclusion

Removing Trojan.Revenge-RAT from your system requires a combination of technical expertise and caution. By following the steps outlined above and using reputable security tools, you can effectively remove the malware and prevent future infections. However, it is essential to remain vigilant and take proactive measures to protect your system, such as keeping your operating system and software up-to-date, using strong antivirus software, and avoiding suspicious downloads or links.

SpyHunter Detects & Remove Trojan.Revenge-RAT

File System Details

Trojan.Revenge-RAT may create the following file(s):
# File Name MD5 Detections
1. Client.exe d44d31f78b1d84b803957e517d70c78b 6
2. xcderfgty.exe eab35fb0f946c8e199d3bfa5f94bc515 2
3. file.exe e17708e8f7ee9a2ad0248e634dc7ac55 1
More files

Registry Details

Trojan.Revenge-RAT may create the following registry entry or registry entries:
Regexp file mask
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Windows.js

Analysis Report

General information

Family Name: Trojan.Revenge-RAT
Signature status: No Signature

Known Samples

MD5: f7f95cde7776936c0cc90253a77a330b
SHA1: 53b9c14cea890878ecd6a50de587fbff5c5d2dcd
SHA256: 61772167A95F7D7EB84337C06144CBBA21B88B0ACE8EF24D59426C7A50E6ACC6
File Size: 16.90 KB, 16896 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have resources
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • .NET
  • NewLateBinding
  • No Version Info
  • x86

Block Information

Total Blocks: 28
Potentially Malicious Blocks: 3
Whitelisted Blocks: 7
Unknown Blocks: 18

Visual Map

? ? ? ? ? ? ? 0 ? ? x ? 0 ? ? ? ? ? ? ? 0 0 ? x x 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateKey
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenEvent
Show More
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtYieldExecution
  • UNKNOWN
User Data Access
  • GetComputerName
  • GetUserObjectInformation
Anti Debug
  • IsDebuggerPresent
Other Suspicious
  • AdjustTokenPrivileges
Encryption Used
  • CryptAcquireContext
Network Winsock2
  • WSASocket
  • WSAStartup
  • WSAttemptAutodialName
Network Winsock
  • closesocket
  • getaddrinfo
  • setsockopt