General

  • Target

    servere.exe

  • Size

    16KB

  • Sample

    240507-3clqbadg9w

  • MD5

    ed6919dea6d7500dd371ee6bd94ed970

  • SHA1

    806fc9cc302465842d01b5b88d21b20c1f121ae5

  • SHA256

    db0ac5dffbc422cf8e25e5e118bc71044018d4f09383f51752b7402eb1aefbe6

  • SHA512

    7ceccef223dd1d0c9cd9a2831d8a1de83047e28120d3e9ac47b49660d2f5c8dd27c424e094dc2f7644078ba8996be8e7736ba02a6906bf1fb5fd71203fb562e3

  • SSDEEP

    384:gLGXnSVdX5/VBji1D9oDPlMNcLlb5sVKqy9y5Ct:gLGXnSVdTBjyclMNEjyo

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

rachelere-35477.portmap.host:35477

Mutex

RV_MUTEX

Targets

    • Target

      servere.exe

    • Size

      16KB

    • MD5

      ed6919dea6d7500dd371ee6bd94ed970

    • SHA1

      806fc9cc302465842d01b5b88d21b20c1f121ae5

    • SHA256

      db0ac5dffbc422cf8e25e5e118bc71044018d4f09383f51752b7402eb1aefbe6

    • SHA512

      7ceccef223dd1d0c9cd9a2831d8a1de83047e28120d3e9ac47b49660d2f5c8dd27c424e094dc2f7644078ba8996be8e7736ba02a6906bf1fb5fd71203fb562e3

    • SSDEEP

      384:gLGXnSVdX5/VBji1D9oDPlMNcLlb5sVKqy9y5Ct:gLGXnSVdTBjyclMNEjyo

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

MITRE ATT&CK Enterprise v15

Tasks