Overview

overview

10

Static

static

5

db68ffa236...4b.exe

windows7-x64

10

db68ffa236...4b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    867d4ec9caf05b90f7baa231b19c8db9392e45ad957cd9d1c10a5113e579b2e1

  • Size

    527KB

  • Sample

    240902-d7pm1s1gqh

  • MD5

    b3cf08918b6b3809053149557dfcc876

  • SHA1

    fd5411a1e7c9a42ba757ed0637cde15bac6f6f17

  • SHA256

    867d4ec9caf05b90f7baa231b19c8db9392e45ad957cd9d1c10a5113e579b2e1

  • SHA512

    c5975d508edae31200d39508293d5c03c1cd0839793bd3a3588b3a174a2d2ef0e621da97ec151dc719c25ab6249b471f9383995525463e56aad518ef2c461c4f

  • SSDEEP

    12288:u0927LBx2fA7WjU2572fH+XJYdcKVfraXjzi:tSnGA7UUk72fMKDGXjzi

Score
10/10
revengeratguestdiscoverytrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

ournewcompany2.hopto.org:333

Mutex

RV_MUTEX

Targets

    • Target

      db68ffa236dd34fb3c092e3b76b511bc16bbc0451c23a4e0a2083b6e744a5f4b

    • Size

      944KB

    • MD5

      84a4cb98d7bce223019fe142191dc5af

    • SHA1

      63386615792f409bf3cbcc78c2a53ae1438bc5ea

    • SHA256

      db68ffa236dd34fb3c092e3b76b511bc16bbc0451c23a4e0a2083b6e744a5f4b

    • SHA512

      1f7b06b720d424782bc31f554e33a6b80f9451076047540bc6744aa2a802824a9c73577f748f6d808195ddaa3354022d8e7ad61b814bd859036ce1944d2d1b32

    • SSDEEP

      12288:gCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBgaH7nhEJes3P:gCdxte/80jYLT3U1jfsWabncesOCKlQ

    Score
    10/10
    revengeratguestdiscoverytrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks