Overview

overview

10

Static

static

c8aa6223ca...ea.exe

windows7_x64

10

c8aa6223ca...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8aa6223ca40f85c1ae6fd9024aab6ea.exe

  • Size

    501KB

  • Sample

    220512-f5efdaafa2

  • MD5

    c8aa6223ca40f85c1ae6fd9024aab6ea

  • SHA1

    895469c785046dce30badb4de957f5f89657ba0b

  • SHA256

    2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

  • SHA512

    9800a04b8b408940e0c54a752fc87b41edd79d7764cbb16a0357084ee8b1dc3d3a082b424ee3f68632cbb128bde0e867854e2216ec88de48c247d5c248bed530

Score
10/10
revengeratpersistencestealertrojan

Malware Config

Targets

    • Target

      c8aa6223ca40f85c1ae6fd9024aab6ea.exe

    • Size

      501KB

    • MD5

      c8aa6223ca40f85c1ae6fd9024aab6ea

    • SHA1

      895469c785046dce30badb4de957f5f89657ba0b

    • SHA256

      2932091c4558a42772f48d84e38ce9e2133aecc4d6c1cb7a2ec06dcf41f2b05b

    • SHA512

      9800a04b8b408940e0c54a752fc87b41edd79d7764cbb16a0357084ee8b1dc3d3a082b424ee3f68632cbb128bde0e867854e2216ec88de48c247d5c248bed530

    Score
    10/10
    revengeratpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks