revengerat | 56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc | Triage

Sharing

General

Target

e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118
Size

16KB
Sample

240914-yqx82stbld
MD5

e0ee27afb4f7265a4d4459db6a4d6c04
SHA1

22f327c88557888de0e3051b803574b36b165f39
SHA256

56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc
SHA512

664d38c7fb0dc768c8d06d454383cf0a85238bc2d68250d9ec9bbc52da7d2d0c4ea8919df5cfc53808ae7e2f41e8415aaa7812823cb9d71fa3d616ca12061bec
SSDEEP

384:r2ZilPqtlJES8ur9k4NcKlb5suLUyp5Ct:r2ZilPqtlFrlNzpo

Score

10^/10

revengerat parrot-security stealer

Malware Config

Extracted

Family

revengerat

Botnet

PARROT-SECURITY

C2

3.tcp.ngrok.io:24041

Mutex

RV_MUTEX-GgZblRvZwfRtNHu

Targets

- Target
  
  e0ee27afb4f7265a4d4459db6a4d6c04_JaffaCakes118
- Size
  
  16KB
- MD5
  
  e0ee27afb4f7265a4d4459db6a4d6c04
- SHA1
  
  22f327c88557888de0e3051b803574b36b165f39
- SHA256
  
  56e5859ed8dc27386e209b3cd4959be7c76c33b0b59deb8e4449cf23e99d4cbc
- SHA512
  
  664d38c7fb0dc768c8d06d454383cf0a85238bc2d68250d9ec9bbc52da7d2d0c4ea8919df5cfc53808ae7e2f41e8415aaa7812823cb9d71fa3d616ca12061bec
- SSDEEP
  
  384:r2ZilPqtlJES8ur9k4NcKlb5suLUyp5Ct:r2ZilPqtlFrlNzpo
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

stealerparrot-securityrevengerat

behavioral1

behavioral2