revengerat

General

Target

Ff2 external.zip
Size

15KB
Sample

240731-k35l1a1hrf
MD5

b7b23f0fb1e8d035371a4b2a7f4a6008
SHA1

ff885b7b4bdbdba23e0d540f28ef4ffdf5072adb
SHA256

07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380
SHA512

d0cb3406b65c157095e4ddc592d39f00a43cd8c686143ce3ead7469e29f4e80756787b479ffbecaa7f016287532efcb0e33ed3b8170ffad4573421304991bcad
SSDEEP

3:vhj/NVlllUtxgEEAI2tvbGllnZ5i2Qz//Z6+4Fz/RjllNVlllUll9xgEEAI7uWlp:5jb/qTIy2TU5rc15jb/q7IqWl+lMt

Score

10^/10

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Targets

- Target
  
  Ff2 external.zip
- Size
  
  15KB
- MD5
  
  b7b23f0fb1e8d035371a4b2a7f4a6008
- SHA1
  
  ff885b7b4bdbdba23e0d540f28ef4ffdf5072adb
- SHA256
  
  07569cd953006587d716ee60b284baf1d77bfbd77706395b2c3b504d76267380
- SHA512
  
  d0cb3406b65c157095e4ddc592d39f00a43cd8c686143ce3ead7469e29f4e80756787b479ffbecaa7f016287532efcb0e33ed3b8170ffad4573421304991bcad
- SSDEEP
  
  3:vhj/NVlllUtxgEEAI2tvbGllnZ5i2Qz//Z6+4Fz/RjllNVlllUll9xgEEAI7uWlp:5jb/qTIy2TU5rc15jb/q7IqWl+lMt
Score

10^/10

revengerat guest discovery macro macro_on_action persistence stealer trojan upx
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- RevengeRat Executable
  stealer
- Contacts a large (1382) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Downloads MZ/PE file
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Drops startup file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses the VBS compiler for execution
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  Ff2 external/ff2 script.exe
- Size
  
  15.0MB
- MD5
  
  14b17234e237505421b6492b8d757507
- SHA1
  
  48eba0e45eebde154bb49322e5098cea67717de1
- SHA256
  
  167b76d3a8d20df15c421d48877c330597f6309d6b55c7b5327df5d89a51423f
- SHA512
  
  8275df99cc31e7b7259799b480438186513b37f4558472b22bd2e85741845e76cc0b99f1a6030222a8ee8f1098d206cdd6c1206432214bc5f3c270f93b87e92e
- SSDEEP
  
  3::
Score

1^/10
behavioral3 behavioral4