Overview

overview

10

Static

static

e80c263898...bf.exe

windows7_x64

10

e80c263898...bf.exe

windows10-2004_x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e80c263898c20c3312264ecb17dc37e3752562233f99c55bddd7fe2fc1cecbbf

  • Size

    81KB

  • Sample

    220625-lgcjrseggm

  • MD5

    f44f71fbbb725def604dc7681163d7c3

  • SHA1

    a270d1637bb509f72de959461286421ace9cc7e7

  • SHA256

    e80c263898c20c3312264ecb17dc37e3752562233f99c55bddd7fe2fc1cecbbf

  • SHA512

    4c366b0162f3949e5c62c744d4fd62d43dc8e07f9177c2bd25484ea9e43d714ddf46ff5af5192d7dacad04fd826d59a55ed2871dd318b307333abfcaa0edfd36

Score
10/10
revengeratpaulinhaaastealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

PAULINHAAA

C2

4099.ddns.net:1515

popup.duckdns.org:1515
Mutex

RV_MUTEX-NNHuiGGjjtnxD

Targets

    • Target

      e80c263898c20c3312264ecb17dc37e3752562233f99c55bddd7fe2fc1cecbbf

    • Size

      81KB

    • MD5

      f44f71fbbb725def604dc7681163d7c3

    • SHA1

      a270d1637bb509f72de959461286421ace9cc7e7

    • SHA256

      e80c263898c20c3312264ecb17dc37e3752562233f99c55bddd7fe2fc1cecbbf

    • SHA512

      4c366b0162f3949e5c62c744d4fd62d43dc8e07f9177c2bd25484ea9e43d714ddf46ff5af5192d7dacad04fd826d59a55ed2871dd318b307333abfcaa0edfd36

    Score
    10/10
    revengeratpaulinhaaastealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks