Overview

overview

10

Static

static

56f35b4b99...a3.exe

windows7_x64

10

56f35b4b99...a3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    56f35b4b99a1cce723b70a146df402a3

  • Size

    268KB

  • Sample

    201214-2bm5ksdqvs

  • MD5

    56f35b4b99a1cce723b70a146df402a3

  • SHA1

    1e10ce79734ce11391965bd29d4fa911f9578550

  • SHA256

    1e391dfa8394aa88e5ba9fead3b9486a9af0e160346c71f9c61bf0e11188f5fe

  • SHA512

    aa5dfb9d10dc233ebb3d87fa113b57c4a69bc99e5b74dc170217a70244efa5935e77ca0dc6defe5b19b9addc99ab4c1870a6eeb0a839411831837d6e01b1e0cd

Score
10/10
revengeratxzimpersistencestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

xzim

C2

xzim.ddns.net:4444

Mutex

RV_MUTEX-UClgZblRvZwfR

Targets

    • Target

      56f35b4b99a1cce723b70a146df402a3

    • Size

      268KB

    • MD5

      56f35b4b99a1cce723b70a146df402a3

    • SHA1

      1e10ce79734ce11391965bd29d4fa911f9578550

    • SHA256

      1e391dfa8394aa88e5ba9fead3b9486a9af0e160346c71f9c61bf0e11188f5fe

    • SHA512

      aa5dfb9d10dc233ebb3d87fa113b57c4a69bc99e5b74dc170217a70244efa5935e77ca0dc6defe5b19b9addc99ab4c1870a6eeb0a839411831837d6e01b1e0cd

    Score
    10/10
    revengeratxzimpersistencestealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks