Overview

overview

10

Static

static

10

3f5d94ceb5...e7.exe

windows7_x64

10

3f5d94ceb5...e7.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
  • Size 17KB
  • Sample220701-b9dbnaggc7
  • SHA256 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
  • MD5 SHA1 SHA512
Score
10/10
revengeratthe newstealertrojan

Malware Config

Extracted

Family

  • revengerat

Botnet

  • The New

C2

  • wowhu.zapto.org:5550

  • wowhu.zapto.org:5551

  • wowhu.zapto.org:5552

  • wowhu.zapto.org:5553

  • wowhu.zapto.org:5554

  • wowhu.zapto.org:5555

  • haxballfc.ddns.net:5550

  • haxballfc.ddns.net:5551

  • haxballfc.ddns.net:5552

  • haxballfc.ddns.net:5553

  • haxballfc.ddns.net:5554

  • haxballfc.ddns.net:5555

  • linkshosts.ddns.net:5550

  • linkshosts.ddns.net:5551

  • linkshosts.ddns.net:5552

  • linkshosts.ddns.net:5553

  • linkshosts.ddns.net:5554

  • linkshosts.ddns.net:5555

  • gaminghost.ddns.net:5550

  • gaminghost.ddns.net:5551

Mutex

  • RV_MUTEX-IPcYBGldGoFYE

Targets

    • Target
      3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
    • Size 17KB
    • SHA256 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
    • MD5 SHA1 SHA512
    Score
    10/10
    revengeratthe newstealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks