revengerat | 116fa0f553b0b761790ed3c66cc2d03d05adf61a0a79ad88b28109527a2c4eba | Triage

Sharing

General

Target

04ed47e9a2a757c11e3aed3d2b39d0e0_JaffaCakes118
Size

16KB
Sample

240728-bxs7cazgmk
MD5

04ed47e9a2a757c11e3aed3d2b39d0e0
SHA1

ee5075a09ac6a28bbd050462256be0cf449d7a1d
SHA256

116fa0f553b0b761790ed3c66cc2d03d05adf61a0a79ad88b28109527a2c4eba
SHA512

790d6b8ece43d63c1c9344f0036a1f0f8e28035a278682b789873218f107855f152ac95362a85367dba18fb44a996a98d126f4d064926afea338188f9b4e44c4
SSDEEP

384:dcfTZMRYiVdf2QyYI79IxJAd3pNcClb5s+OOyL5Ct:dcfTZMRYiVdu3xuL63pNrQo

Score

10^/10

revengerat guest stealer

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:9753

Mutex

RV_MUTEX

Targets

- Target
  
  04ed47e9a2a757c11e3aed3d2b39d0e0_JaffaCakes118
- Size
  
  16KB
- MD5
  
  04ed47e9a2a757c11e3aed3d2b39d0e0
- SHA1
  
  ee5075a09ac6a28bbd050462256be0cf449d7a1d
- SHA256
  
  116fa0f553b0b761790ed3c66cc2d03d05adf61a0a79ad88b28109527a2c4eba
- SHA512
  
  790d6b8ece43d63c1c9344f0036a1f0f8e28035a278682b789873218f107855f152ac95362a85367dba18fb44a996a98d126f4d064926afea338188f9b4e44c4
- SSDEEP
  
  384:dcfTZMRYiVdf2QyYI79IxJAd3pNcClb5s+OOyL5Ct:dcfTZMRYiVdu3xuL63pNrQo
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

stealerguestrevengerat

behavioral1

behavioral2