Overview

overview

10

Static

static

1

images (2).jpg

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    images (2).jpg

  • Size

    7KB

  • Sample

    240402-aszynabg58

  • MD5

    b613609f0d876a9f19846c1a89927c6d

  • SHA1

    65d507cea1dc9b1df2766096e40cb7c379cc9d24

  • SHA256

    217f0596e693286fe97c281166d3060e586663e7e779331fc9f0f148dcea908d

  • SHA512

    9efb1e2dc0ca873408be7b86a1d1dfbc688665cf3dd504fccdb680b0c8420882116155b97a4958539677426f3cce9aa9c260ce43764ca67a2af02ca706d31c32

  • SSDEEP

    96:5KgLSWHJqLXILuY3Lo8ciODd/1fU4cNgS0qomuK/YSqGxBa8pb+jYQjsX8IXQ0en:8GLQILu+Loz7S0q7/JqGm8pb+yXLgXh5

Score
10/10
revengeratguestpersistencestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Targets

    • Target

      images (2).jpg

    • Size

      7KB

    • MD5

      b613609f0d876a9f19846c1a89927c6d

    • SHA1

      65d507cea1dc9b1df2766096e40cb7c379cc9d24

    • SHA256

      217f0596e693286fe97c281166d3060e586663e7e779331fc9f0f148dcea908d

    • SHA512

      9efb1e2dc0ca873408be7b86a1d1dfbc688665cf3dd504fccdb680b0c8420882116155b97a4958539677426f3cce9aa9c260ce43764ca67a2af02ca706d31c32

    • SSDEEP

      96:5KgLSWHJqLXILuY3Lo8ciODd/1fU4cNgS0qomuK/YSqGxBa8pb+jYQjsX8IXQ0en:8GLQILu+Loz7S0q7/JqGm8pb+yXLgXh5

    Score
    10/10
    revengeratguestpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Downloads MZ/PE file

    • Drops startup file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

1
T1064

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks