Overview

overview

10

Static

static

10

renekton2‮GPJ..exe

windows7_x64

10

renekton2‮GPJ..exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    renekton2‮GPJ..exe

  • Size

    20KB

  • Sample

    201120-9e772f792e

  • MD5

    126bd8afd4b7c1ad5676e489e7463511

  • SHA1

    f08b87f487d7ea75a97ac10a7d995b5e83187f72

  • SHA256

    ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454

  • SHA512

    71a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06

Score
10/10
revengeratclientstealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Client

C2

127.0.0.1:333

127.0.0.1:37337
Mutex

RV_MUTEX

Targets

    • Target

      renekton2‮GPJ..exe

    • Size

      20KB

    • MD5

      126bd8afd4b7c1ad5676e489e7463511

    • SHA1

      f08b87f487d7ea75a97ac10a7d995b5e83187f72

    • SHA256

      ca58619fd5de06d3b93040f7c7436887d73bfd11f5d8abc6abaa07fb35fbc454

    • SHA512

      71a541dcf831a8d0b684356e777beb95dfe838d71c781b92c7128691cd5f9418c30340511891239500e60f2feeed3bb383adc0b212b97a37b40cff9af814bf06

    Score
    10/10
    revengeratclientstealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks