revengerat | 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7

General

Target
3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
Size 17KB
Sample220701-b9dbnaggc7
SHA256 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
MD5 1098d8e6429779b56a6b6a542cd3bc11
SHA1 73f6b9c7b6cf16d2abdf3a6ec06b0ac2aeb62af5
SHA512 825a655df4440f3f4a072fe0ff4ab5d237cae5f3485d3bd51ce8053bf336aa4286f0e16d796e83c40c99d236cbe08c54b6914e34a5b307968d3d3fb88aa977a0
SSDEEP 384:jDv64MO8VKPBoELeNsvnbqsVKBXxyHZ3s2:jDvUHE/Le2OIB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealer the new revengerat

Malware Config

Extracted

Family

revengerat

Botnet

The New

C2

wowhu.zapto.org:5550
wowhu.zapto.org:5551
wowhu.zapto.org:5552
wowhu.zapto.org:5553
wowhu.zapto.org:5554
wowhu.zapto.org:5555
haxballfc.ddns.net:5550
haxballfc.ddns.net:5551
haxballfc.ddns.net:5552
haxballfc.ddns.net:5553
haxballfc.ddns.net:5554
haxballfc.ddns.net:5555
linkshosts.ddns.net:5550
linkshosts.ddns.net:5551
linkshosts.ddns.net:5552
linkshosts.ddns.net:5553
linkshosts.ddns.net:5554
linkshosts.ddns.net:5555
gaminghost.ddns.net:5550
gaminghost.ddns.net:5551
gaminghost.ddns.net:5552
gaminghost.ddns.net:5553
gaminghost.ddns.net:5554
gaminghost.ddns.net:5555
worldsez.publicvm.com:5550
worldsez.publicvm.com:5551
worldsez.publicvm.com:5552
worldsez.publicvm.com:5553
worldsez.publicvm.com:5554
worldsez.publicvm.com:5555
lighttech.publicvm.com:5550
lighttech.publicvm.com:5551
lighttech.publicvm.com:5552
lighttech.publicvm.com:5553
lighttech.publicvm.com:5554
lighttech.publicvm.com:5555

Mutex

RV_MUTEX-IPcYBGldGoFYE

Signatures

RevengeRat Executable 1 IoCs

stealer

resource	yara_rule
sample	revengerat

Revengerat family
revengerat

File Explorer

3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7

.exe 17KB

3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3f5d94ceb5367b224386438511aa78c245d977846a71fcd8ffa6c6470d1b3fe7
MD5 1098d8e6429779b56a6b6a542cd3bc11
SHA1 73f6b9c7b6cf16d2abdf3a6ec06b0ac2aeb62af5
SHA512 825a655df4440f3f4a072fe0ff4ab5d237cae5f3485d3bd51ce8053bf336aa4286f0e16d796e83c40c99d236cbe08c54b6914e34a5b307968d3d3fb88aa977a0
SSDEEP 384:jDv64MO8VKPBoELeNsvnbqsVKBXxyHZ3s2:jDvUHE/Le2OIB
MD5 SHA1 SHA512 SSDEEP

windows x86

RevengeRat Executable

stealer

Minor OS version

Major OS version

Entry point

24526

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing