revengerat | 6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d | Triage

Sharing

General

Target

6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d
Size

17KB
Sample

230310-leddaaec41
MD5

655f6edee75a4cc49a8fa34567037da9
SHA1

9ff2fc0ccc94230411c3f1507c648867e2306f14
SHA256

6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d
SHA512

69754378ec7480c708aa3b7e979d0ec465b3e499e811d4a89ff1d5b863f7a796f8d5893fdcc90831c1374dd63782de3d02a06934564ddd1406fcbce98c63d89b
SSDEEP

384:kGbJcK05FdBu6wCX9oDPlMNcLlb5sVKOyv5Ct0:kGbqK2DQUclMNEhou

Score

10^/10

revengerat guest stealer trojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

127.0.0.1:333

127.0.0.1:37734

127.0.0.1:12792

songs-travel.at.ply.gg:333

songs-travel.at.ply.gg:37734

songs-travel.at.ply.gg:12792

tcp://5.tcp.eu.ngrok.io:333

tcp://5.tcp.eu.ngrok.io:37734

tcp://5.tcp.eu.ngrok.io:12792

Mutex

RV_MUTEX

Targets

- Target
  
  6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d
- Size
  
  17KB
- MD5
  
  655f6edee75a4cc49a8fa34567037da9
- SHA1
  
  9ff2fc0ccc94230411c3f1507c648867e2306f14
- SHA256
  
  6481f9e27bec4cf6702b6d6a09761c62782f5010da0dfd0a396575c60200279d
- SHA512
  
  69754378ec7480c708aa3b7e979d0ec465b3e499e811d4a89ff1d5b863f7a796f8d5893fdcc90831c1374dd63782de3d02a06934564ddd1406fcbce98c63d89b
- SSDEEP
  
  384:kGbJcK05FdBu6wCX9oDPlMNcLlb5sVKOyv5Ct0:kGbqK2DQUclMNEhou
Score

10^/10

revengerat guest stealer trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- RevengeRat Executable
  stealer
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

stealerguestrevengerat

behavioral1

revengeratgueststealertrojan