General

  • Target

    d36dd01b3378deeaa54f64ffb33d9b752bc28ecc832a83a2a0c974f2eae77508

  • Size

    24KB

  • Sample

    220512-cwwfrababj

  • MD5

    9b30e0894ba18b3a4fe54359c5c5363b

  • SHA1

    f1546abf3818a139f1da3ff9e2b36e17c5d88279

  • SHA256

    d36dd01b3378deeaa54f64ffb33d9b752bc28ecc832a83a2a0c974f2eae77508

  • SHA512

    94ea4bc1660b01a5fa677c4a56d77bccdf270d74b3714adccc19acd4bcffa5e5967930fb2fa3755b03171fd0e239dc2d4ac4cce923ed758a648c4cc905b92a07

Malware Config

Extracted

Family

revengerat

Mutex

Targets

    • Target

      d36dd01b3378deeaa54f64ffb33d9b752bc28ecc832a83a2a0c974f2eae77508

    • Size

      24KB

    • MD5

      9b30e0894ba18b3a4fe54359c5c5363b

    • SHA1

      f1546abf3818a139f1da3ff9e2b36e17c5d88279

    • SHA256

      d36dd01b3378deeaa54f64ffb33d9b752bc28ecc832a83a2a0c974f2eae77508

    • SHA512

      94ea4bc1660b01a5fa677c4a56d77bccdf270d74b3714adccc19acd4bcffa5e5967930fb2fa3755b03171fd0e239dc2d4ac4cce923ed758a648c4cc905b92a07

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Command and Control

Web Service

1
T1102

Tasks