Overview

overview

10

Static

static

7

a8bcd5d535...09.exe

windows7-x64

10

a8bcd5d535...09.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8bcd5d5355bbc74ed713d87038c8f09

  • Size

    742KB

  • Sample

    240227-kr2qzacf85

  • MD5

    a8bcd5d5355bbc74ed713d87038c8f09

  • SHA1

    fbb20b23b0def929b0ec0fad6608168a67b7adfe

  • SHA256

    ccc0bd7cb872675f8a49733bdd68bb7952093202a6b6ecb6610088a56ea1b269

  • SHA512

    7d9e5ffff1a2afb57fa67da17127c39ff1a8da3382b9c2af5cc44277e43bb1063d18bc29f6eb750b62853761f787a5447b5265b3779a7009f2e15d26cf0cef09

  • SSDEEP

    12288:qjkArEN249AyE/rbaMct4bO2/VZIEU9Dh3vcF4bIEUl5ddXvy6kjYl+w:tFE//Tct4bOsjItd3vCgQB

Score
10/10
revengeratgueststealertrojanupx

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

192.168.178.1:4662

192.168.178.32:4662
Mutex

RV_MUTEX-YPcYBGldGoFYEKg

Targets

    • Target

      a8bcd5d5355bbc74ed713d87038c8f09

    • Size

      742KB

    • MD5

      a8bcd5d5355bbc74ed713d87038c8f09

    • SHA1

      fbb20b23b0def929b0ec0fad6608168a67b7adfe

    • SHA256

      ccc0bd7cb872675f8a49733bdd68bb7952093202a6b6ecb6610088a56ea1b269

    • SHA512

      7d9e5ffff1a2afb57fa67da17127c39ff1a8da3382b9c2af5cc44277e43bb1063d18bc29f6eb750b62853761f787a5447b5265b3779a7009f2e15d26cf0cef09

    • SSDEEP

      12288:qjkArEN249AyE/rbaMct4bO2/VZIEU9Dh3vcF4bIEUl5ddXvy6kjYl+w:tFE//Tct4bOsjItd3vCgQB

    Score
    10/10
    revengeratgueststealertrojanupx

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks