Overview

overview

10

Static

static

10

5f59284e27...af.exe

windows7_x64

10

5f59284e27...af.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5f59284e2744ad6c645ec3b837af0ad20b9577d6439c4edf32f0ab30ef0bceaf

  • Size

    110KB

  • Sample

    220520-enpz4shbd3

  • MD5

    e8803432a8c66bd6dccfdcc66135c5c6

  • SHA1

    f278f4874a7d85234351f48c49ce49a147d7d064

  • SHA256

    5f59284e2744ad6c645ec3b837af0ad20b9577d6439c4edf32f0ab30ef0bceaf

  • SHA512

    3231777d1922a81e5c47f1db846ac8ceef3698bd4e61ca1d68aada3f97c82a0043dd9d51a95f7b68fbe303554ecefa5beb3314d44da0527807a9ccc12ffe6edd

Score
10/10
revengeratdllhost.exestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

dllhost.exe

C2

ki0t9ol5puytgrfe.ddns.net:3332

ki0t9ol5puytgrfe.ddns.net:15745

0.tcp.ngrok.io:3332

0.tcp.ngrok.io:15745
Mutex

RV_MUTEX-lawrHJfWfhaRC

Targets

    • Target

      5f59284e2744ad6c645ec3b837af0ad20b9577d6439c4edf32f0ab30ef0bceaf

    • Size

      110KB

    • MD5

      e8803432a8c66bd6dccfdcc66135c5c6

    • SHA1

      f278f4874a7d85234351f48c49ce49a147d7d064

    • SHA256

      5f59284e2744ad6c645ec3b837af0ad20b9577d6439c4edf32f0ab30ef0bceaf

    • SHA512

      3231777d1922a81e5c47f1db846ac8ceef3698bd4e61ca1d68aada3f97c82a0043dd9d51a95f7b68fbe303554ecefa5beb3314d44da0527807a9ccc12ffe6edd

    Score
    10/10
    revengeratdllhost.exestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks