Overview

overview

10

Static

static

10

43SjNv5s.exe

windows7_x64

10

43SjNv5s.exe

windows10_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    43SjNv5s.exe

  • Size

    21KB

  • Sample

    201201-bfqa3ap92x

  • MD5

    aa9f37ce187d4b4556807f49f57ca678

  • SHA1

    d4c05259f35840e96232bc41e1bd14defc73988f

  • SHA256

    ae53e7a0d59686d3684ed1e14bfee649f53a5fd369090d916a81f74091368b65

  • SHA512

    1f0aed05bc5574f62f8cfe3bf586390dd98e25593f17b8178029fdbdaa96d819de758f0dbdc65ef2163478def9caeb0ac9fb4689c04e71156c4967496a965baa

Score
10/10
revengeratguestspywarestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

4.tcp.ngrok.io:13284

Mutex

RV_MUTEX-sawrHJfWfhaRClg

Targets

    • Target

      43SjNv5s.exe

    • Size

      21KB

    • MD5

      aa9f37ce187d4b4556807f49f57ca678

    • SHA1

      d4c05259f35840e96232bc41e1bd14defc73988f

    • SHA256

      ae53e7a0d59686d3684ed1e14bfee649f53a5fd369090d916a81f74091368b65

    • SHA512

      1f0aed05bc5574f62f8cfe3bf586390dd98e25593f17b8178029fdbdaa96d819de758f0dbdc65ef2163478def9caeb0ac9fb4689c04e71156c4967496a965baa

    Score
    10/10
    revengeratguestspywarestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks