revengerat | 038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f | Triage

Sharing

General

Target

5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118
Size

16KB
Sample

240729-ydv8xs1flb
MD5

5bcbe8f7299bcd8e63f34def74b24b72
SHA1

e320580d43588a2276b5da3e076a25daac6f8155
SHA256

038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f
SHA512

92e810178b86055014d3c57853a2f3257e833ebb0a175b5b4fc6acd75f2ee9aa98c22eb265986fa372bdd588a2dced6a3cf43173dccb9a43e22df3c1161b81e2
SSDEEP

384:1ZilPqtlJES8Zr9muhNculb5sBEiy05Ct:1ZilPqtlFUwuhNfYo

Score

10^/10

revengerat parrot-security stealer

Malware Config

Extracted

Family

revengerat

Botnet

PARROT-SECURITY

C2

0.tcp.ngrok.io:19356

Mutex

RV_MUTEX-OFhewuYaFRGbKiZ

Targets

- Target
  
  5bcbe8f7299bcd8e63f34def74b24b72_JaffaCakes118
- Size
  
  16KB
- MD5
  
  5bcbe8f7299bcd8e63f34def74b24b72
- SHA1
  
  e320580d43588a2276b5da3e076a25daac6f8155
- SHA256
  
  038391b2020f10bc643e322fd0f668af217f5415c1f030454080bf34fcae538f
- SHA512
  
  92e810178b86055014d3c57853a2f3257e833ebb0a175b5b4fc6acd75f2ee9aa98c22eb265986fa372bdd588a2dced6a3cf43173dccb9a43e22df3c1161b81e2
- SSDEEP
  
  384:1ZilPqtlJES8Zr9muhNculb5sBEiy05Ct:1ZilPqtlFUwuhNfYo
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

stealerparrot-securityrevengerat

behavioral1

behavioral2