Overview

overview

10

Static

static

8bf630162e...d5.exe

windows7_x64

10

8bf630162e...d5.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5

  • Size

    252KB

  • Sample

    220215-mejqqsfbfl

  • MD5

    cddfcb26e8cf825911344503abeed368

  • SHA1

    d15ef21fe133d47b2305925acdf139bff417062e

  • SHA256

    8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5

  • SHA512

    1d1b3e7701cf7d03079d677245980acb92eb1c23076ea2ff3325f4efdaac82cbd62efb0be436320fee2882e1830a34b77960c4cd9ed42bcaa1c159d008fba472

Score
10/10
revengeratnov333stealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Nov333

C2

80.82.68.21:3333

Mutex

RV_MUTEX-FtNHuiGGjjtnxDp

Targets

    • Target

      8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5

    • Size

      252KB

    • MD5

      cddfcb26e8cf825911344503abeed368

    • SHA1

      d15ef21fe133d47b2305925acdf139bff417062e

    • SHA256

      8bf630162e5a475cba1e37f56353169e57083b39b6e7a47ff30f63d228ce9bd5

    • SHA512

      1d1b3e7701cf7d03079d677245980acb92eb1c23076ea2ff3325f4efdaac82cbd62efb0be436320fee2882e1830a34b77960c4cd9ed42bcaa1c159d008fba472

    Score
    10/10
    revengeratnov333stealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • RevengeRat Executable

      stealer

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks