Revenge is a Dish Best Served… Obfuscated?

Binary Defense analyzed a multi-stage VBS/HTA email-delivered downloader that fetches obfuscated scripts from an open directory and a WordPress-hosted path to install RevengeRAT (Base64 PE executed from memory) and WSHRAT (VBScript stealer). The loader achieves persistence via Run keys and stores an obfuscated Base64 PE in the registry for fileless execution; the report includes detailed IOCs (file hashes, mutex, C2 domains/IPs, registry keys) and remediation guidance.