Overview

overview

10

Static

static

10

FA95D5E77F...69.exe

windows7-x64

10

FA95D5E77F...69.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    FA95D5E77FD4FAB91662C9B1E460807647ACB25769469.exe

  • Size

    20KB

  • Sample

    221110-mbcs1sghg8

  • MD5

    e261906d0d1ceb7b801b380e94515e6b

  • SHA1

    71a98ad89380f2fc81ded0d203f7e29ef1d61e2c

  • SHA256

    fa95d5e77fd4fab91662c9b1e460807647acb25769469110b59fb6485b17cc8d

  • SHA512

    f61539231a486ebfc485f0ef7bb617fdb16a8b7513536b9eb57dabd4740af04c0a2bb3cc784a89bcec2054f33387a9286a19ebb3e8653968e6320e717db41239

  • SSDEEP

    384:Ri9FmEqiF1x4our05GkoEIPJvnbisVKfwytLu2s2QCzYcHe+Z:Ri9F5qiFMouUDIRmDxa2nzYcHe+Z

Score
10/10
revengeratphitrinhstealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

phitrinh

C2

nhockgame1230.zapto.org:6722

Mutex

RV_MUTEX

Targets

    • Target

      FA95D5E77FD4FAB91662C9B1E460807647ACB25769469.exe

    • Size

      20KB

    • MD5

      e261906d0d1ceb7b801b380e94515e6b

    • SHA1

      71a98ad89380f2fc81ded0d203f7e29ef1d61e2c

    • SHA256

      fa95d5e77fd4fab91662c9b1e460807647acb25769469110b59fb6485b17cc8d

    • SHA512

      f61539231a486ebfc485f0ef7bb617fdb16a8b7513536b9eb57dabd4740af04c0a2bb3cc784a89bcec2054f33387a9286a19ebb3e8653968e6320e717db41239

    • SSDEEP

      384:Ri9FmEqiF1x4our05GkoEIPJvnbisVKfwytLu2s2QCzYcHe+Z:Ri9F5qiFMouUDIRmDxa2nzYcHe+Z

    Score
    10/10
    revengeratphitrinhstealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks