Overview

overview

10

Static

static

10

76de0b9545...18.exe

windows7-x64

10

76de0b9545...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76de0b9545606106f1cf79f9fa3cbe3e_JaffaCakes118

  • Size

    17KB

  • Sample

    240730-sprrzswdmq

  • MD5

    76de0b9545606106f1cf79f9fa3cbe3e

  • SHA1

    70137b6ded4abca800ca0ef88b6b10e6c24be741

  • SHA256

    2dd6421f948f25090a18784cab9348d5f5ab04b5b84a386f4ef7a70b19c61236

  • SHA512

    f4bc4e9ba377cfecbfbe056de7b31d73bd36f0f6487467288244a6bd932ba127a03bcb71473d9ef6123c05dd8c60d2d9041c76ea02b5751549cf5cd1cccbbfef

  • SSDEEP

    384:1J7Jt6iJXyhIiVTIPIvnbisV1dYRqyRLu2s2:1J7JtzCNdIomIoFa2

Score
10/10
revengeratmikoedpersistencestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Mikoed

C2

127.0.0.1:4040

69.87.219.76:4040
Mutex

RV_MUTEX

Targets

    • Target

      76de0b9545606106f1cf79f9fa3cbe3e_JaffaCakes118

    • Size

      17KB

    • MD5

      76de0b9545606106f1cf79f9fa3cbe3e

    • SHA1

      70137b6ded4abca800ca0ef88b6b10e6c24be741

    • SHA256

      2dd6421f948f25090a18784cab9348d5f5ab04b5b84a386f4ef7a70b19c61236

    • SHA512

      f4bc4e9ba377cfecbfbe056de7b31d73bd36f0f6487467288244a6bd932ba127a03bcb71473d9ef6123c05dd8c60d2d9041c76ea02b5751549cf5cd1cccbbfef

    • SSDEEP

      384:1J7Jt6iJXyhIiVTIPIvnbisV1dYRqyRLu2s2:1J7JtzCNdIomIoFa2

    Score
    10/10
    revengeratmikoedpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks