General

  • Target

    Online.bat

  • Size

    45KB

  • Sample

    240507-3bsggadg4y

  • MD5

    1a600b2249b39f991262c170cad3dad3

  • SHA1

    25d531b3963fd4d26689a3c662ce690ea6ea176a

  • SHA256

    fde691fd5ed16873f0376db8eaa0bac17664065bd22c6c68911e42d33061029a

  • SHA512

    f95fd734986e7a28be3ccae0bb233f54bd092d6e19eb9d6fb2dd38ebe9e5997e3e18c33d62cda3ce934945608b842fc3c9ed459e0f6f2bca376716e49a56e787

  • SSDEEP

    768:LSHL8RIxl3aG5e+XiyXbmPwdDrKaWlr77nKNw4kCThakKTqIJN3iI0:4L8WHy+DLmPwdGlrnwhagIn3i9

Malware Config

Extracted

Family

revengerat

Mutex

Targets

    • Target

      Online.bat

    • Size

      45KB

    • MD5

      1a600b2249b39f991262c170cad3dad3

    • SHA1

      25d531b3963fd4d26689a3c662ce690ea6ea176a

    • SHA256

      fde691fd5ed16873f0376db8eaa0bac17664065bd22c6c68911e42d33061029a

    • SHA512

      f95fd734986e7a28be3ccae0bb233f54bd092d6e19eb9d6fb2dd38ebe9e5997e3e18c33d62cda3ce934945608b842fc3c9ed459e0f6f2bca376716e49a56e787

    • SSDEEP

      768:LSHL8RIxl3aG5e+XiyXbmPwdDrKaWlr77nKNw4kCThakKTqIJN3iI0:4L8WHy+DLmPwdGlrnwhagIn3i9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

MITRE ATT&CK Enterprise v15

Tasks