revengerat

General

Target

de35000537e325fd8ed05003a1114b71aa7366f23a6185c9d8133a3793673427
Size

17KB
Sample

220201-d2h82sgeh8
MD5

3da06106bf2ae3ced4a95d90600dfb11
SHA1

ef63544e72c8d4cbb75047bdc9504c7a420fd2a7
SHA256

de35000537e325fd8ed05003a1114b71aa7366f23a6185c9d8133a3793673427
SHA512

81c83fcce2ce8e5ad61a43c93f9f1c9926a5df96523147b45d601cbad759aea384577050968b25a5d810153aaf85ba5d85a053768683042636cbed00f840f4a2

Score

10^/10

Malware Config

Extracted

Family

revengerat

Botnet

2SP Force DZ

C2

imaneblueyesvpn.ddns.net:333

Mutex

RV_MUTEX-jpnFwUnoWrUUg

Targets

- Target
  
  de35000537e325fd8ed05003a1114b71aa7366f23a6185c9d8133a3793673427
- Size
  
  17KB
- MD5
  
  3da06106bf2ae3ced4a95d90600dfb11
- SHA1
  
  ef63544e72c8d4cbb75047bdc9504c7a420fd2a7
- SHA256
  
  de35000537e325fd8ed05003a1114b71aa7366f23a6185c9d8133a3793673427
- SHA512
  
  81c83fcce2ce8e5ad61a43c93f9f1c9926a5df96523147b45d601cbad759aea384577050968b25a5d810153aaf85ba5d85a053768683042636cbed00f840f4a2
Score

10^/10

revengerat 2sp force dz persistence stealer trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- RevengeRat Executable
  stealer
- Executes dropped EXE
- Sets service image path in registry
  persistence
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RevengeRat Executable

Executes dropped EXE

Sets service image path in registry

Drops startup file

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2