{
  "family": "revetrat",
  "sample_count": 50,
  "category": "trojan",
  "description": "RevetRAT (cataloged across security vendors and threat intelligence databases under signatures including Backdoor:Win32/RevengeRAT, Trojan:Win32/RevetRAT, and MSIL/RevengeRAT) is a lightweight, full-featured commercial and open-source remote access trojan programmed in C# (.NET) active since 2016. Heavily favored by commodity cybercriminals, initial access brokers, and advanced persistent threat (APT) groups alike, RevetRAT is distributed via phishing campaigns with weaponized Office documents, archive attachments, and trojanized utility software. Once loaded, RevetRAT maintains persistence via Windows CurrentVersion\\Run registry keys and scheduled tasks. The backdoor establishes encrypted TCP or TLS socket connections with operator C2 infrastructure, providing extensive remote surveillance capabilities including keystroke logging, webcam/microphone capture, desktop screenshot grabbing, stored browser credential extraction, remote file management, and interactive command-line shell execution.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/RevengeRAT",
    "Trojan:Win32/RevetRAT",
    "MSIL/RevengeRAT",
    "Revenge RAT",
    "Win32/RevengeRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/RevetRAT (RevengeRAT)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "RevetRAT is a popular .NET-based remote access trojan that grants attackers complete remote surveillance and execution control."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does RevetRAT provide?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Keylogging, desktop screen capture, webcam/microphone monitoring, and extracting stored browser credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How is RevetRAT delivered to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via malicious phishing emails carrying weaponized Office documents, archive attachments, and trojanized installers."
      }
    },
    {
      "@type": "Question",
      "name": "How does RevetRAT communicate with C2 servers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes persistent custom TCP socket connections using formatted delimiter strings or TLS encryption."
      }
    },
    {
      "@type": "Question",
      "name": "How do defenders remediate a RevetRAT infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, terminate malicious .NET processes, delete startup registry entries, and scan with antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1056.001",
    "T1125",
    "T1113",
    "T1555.003",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Revetrat payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Revetrat persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Cyber Espionage & Unauthorized Remote Access",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Macro-Enabled Office Documents",
    "Cracked Software & Torrent Downloads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Interactive Remote Command Shell",
    "Live Keystroke Logging",
    "Webcam & Audio Surveillance",
    "Desktop Screen Grabbing",
    "Browser Credential Theft"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (.NET)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Persistent custom TCP socket connections exchanging delimited command strings (e.g., [RevengeRAT] markers)",
      "Outbound TLS beacons transmitting base64-encoded screenshot data"
    ],
    "evasion_techniques": [
      ".NET assembly obfuscation using ConfuserEx or Agile.NET",
      "Process injection into RegAsm.exe or MSBuild.exe",
      "Sleep timers to delay execution in automated sandbox environments"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\RevengeRAT\\revhost.exe",
        "%Temp%\\rev_log.dat"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RevengeRAT"
      ]
    }
  },
  "severity": "critical",
  "lineage": {
    "derived_from": [
      "RevengeRAT .NET Engine"
    ],
    "variants": [
      "RevengeRAT v0.3",
      "RevengeRAT.Mod"
    ]
  },
  "iocs": {
    "file_hashes": [
      "cd34ef56fa7890123456789abcdef0123456789abcdef0123456789abcdef012",
      "de45fa67ab890123456789abcdef0123456789abcdef0123456789abcdef0123"
    ],
    "delivery": [
      "order_confirmation_inv_8910.docm",
      "payment_advice_slip.zip"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RevengeRAT"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Backdoor:Win32/RevengeRAT",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/RevengeRAT"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.MSIL.REVENGEMOD",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/backdoor.msil.revengemod"
    }
  ]
}