General

  • Target

    ac79c10acc0b7ea11d69f974ec637cb420eebd151147f4ec900ee93ea435461c

  • Size

    87KB

  • Sample

    220207-wxedeafcf2

  • MD5

    d3c80d0b1faf79d5fba28c2ec1a9e30e

  • SHA1

    c863643acb838dea5cb6e103da86cf483a850e70

  • SHA256

    ac79c10acc0b7ea11d69f974ec637cb420eebd151147f4ec900ee93ea435461c

  • SHA512

    9f12af5253bf9e84beea286958903a567aeeede64c9f30e3626ba08bc8c7572aa95a54a9c12a2bebd0f527314c60b912eb29600dd240e28028ac682a07b67d8e

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

fa1con-44457.portmap.host:46552

Mutex

RV_MUTEX

Targets

    • Target

      ac79c10acc0b7ea11d69f974ec637cb420eebd151147f4ec900ee93ea435461c

    • Size

      87KB

    • MD5

      d3c80d0b1faf79d5fba28c2ec1a9e30e

    • SHA1

      c863643acb838dea5cb6e103da86cf483a850e70

    • SHA256

      ac79c10acc0b7ea11d69f974ec637cb420eebd151147f4ec900ee93ea435461c

    • SHA512

      9f12af5253bf9e84beea286958903a567aeeede64c9f30e3626ba08bc8c7572aa95a54a9c12a2bebd0f527314c60b912eb29600dd240e28028ac682a07b67d8e

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v6

Tasks