revengerat | e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f

General

Target

e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
Size

390KB
MD5

49a36c3fefe439b026e487b3058449b9
SHA1

4e2d0ee388679cf52d66573dc36fddc0475b866c
SHA256

e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f
SHA512

0c436994990cccaf8a42e371caa12d26001e30b6bf6220b339a4aedcb18c478dac16932b556c14cb3e439336e3baa64414d520309675543686b454f4c8b852a0

Score

10^/10

Family

revengerat

Botnet

NyanCatRevenge

C2

github-58677.portmap.io:58677

Mutex

c1beda1126de489c96

RevengeRAT
Remote-access trojan with a wide range of capabilities.
trojan revengerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe

description	pid	process	target process
PID 4796 set thread context of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe

description	pid	process	target process
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
PID 4796 wrote to memory of 4976	4796	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe	e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe

C:\Users\Admin\AppData\Local\Temp\e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe
"C:\Users\Admin\AppData\Local\Temp\e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe"
2⤵
PID:4976

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e2dfa50779e19898797df97530eb7c546f5a01a08560e83b3ae2b1e64f44143f.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
memory/4796-130-0x0000000000800000-0x0000000000866000-memory.dmp

Filesize
408KB

Download
memory/4976-131-0x0000000000000000-mapping.dmp

Download
memory/4976-134-0x0000000000780000-0x000000000078A000-memory.dmp

Filesize
40KB

Download
memory/4976-135-0x0000000005270000-0x0000000005814000-memory.dmp

Filesize
5.6MB

Download