revengerat | fec6d44cc82af360aab39f22292c41d92e8a34e0072649be221da8c33b68dca3 | Triage

Sharing

General

Target

9c9d15bd6bc31e26505cd72a25b4d5d1_JaffaCakes118
Size

16KB
Sample

240816-c2r1hszhmc
MD5

9c9d15bd6bc31e26505cd72a25b4d5d1
SHA1

e2a978963b5bf904f27b93c5db2ba85d4b84db70
SHA256

fec6d44cc82af360aab39f22292c41d92e8a34e0072649be221da8c33b68dca3
SHA512

ccc1c8fdef8310b7262c44c6320ad61a04aacd1fc8002c0833d18f0b19364aad3f568b5713cbe5e3788321d997140de82bc0aac66c118f081aebee9c8c9fc4bd
SSDEEP

384:9ZilPqtlJES8uj9bVNc2lb5s4cOyx5Ct:9ZilPqtlFfVVN3co

Score

10^/10

revengerat parrot-security stealer

Malware Config

Extracted

Family

revengerat

Botnet

PARROT-SECURITY

C2

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX-GgZblRvZwfRtNHu

Targets

- Target
  
  9c9d15bd6bc31e26505cd72a25b4d5d1_JaffaCakes118
- Size
  
  16KB
- MD5
  
  9c9d15bd6bc31e26505cd72a25b4d5d1
- SHA1
  
  e2a978963b5bf904f27b93c5db2ba85d4b84db70
- SHA256
  
  fec6d44cc82af360aab39f22292c41d92e8a34e0072649be221da8c33b68dca3
- SHA512
  
  ccc1c8fdef8310b7262c44c6320ad61a04aacd1fc8002c0833d18f0b19364aad3f568b5713cbe5e3788321d997140de82bc0aac66c118f081aebee9c8c9fc4bd
- SSDEEP
  
  384:9ZilPqtlJES8uj9bVNc2lb5s4cOyx5Ct:9ZilPqtlFfVVN3co
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

stealerparrot-securityrevengerat

behavioral1

behavioral2