Overview

overview

10

Static

static

10

9b4826b887...85.exe

windows7_x64

10

9b4826b887...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

  • Size

    4.0MB

  • Sample

    220516-x4mh2agcbk

  • MD5

    1d9045870dbd31e2e399a4e8ecd9302f

  • SHA1

    7857c1ebfd1b37756d106027ed03121d8e7887cf

  • SHA256

    9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

  • SHA512

    9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

Score
10/10
revengeratguestpersistencestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Targets

    • Target

      9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

    • Size

      4.0MB

    • MD5

      1d9045870dbd31e2e399a4e8ecd9302f

    • SHA1

      7857c1ebfd1b37756d106027ed03121d8e7887cf

    • SHA256

      9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

    • SHA512

      9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

    Score
    10/10
    revengeratgueststealertrojanpersistence

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks