revengerat

General

Target
acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
Size 17KB
Sample241001-rwce7sthkr
SHA256 acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595
MD5 af48897e401a79baf8086585c18cf8fe
SHA1 44e9a2699d07cbba45493000287ab5dfbe86df77
SHA512 c65d348d3225e86909e33e9ef9717be72ea7f934b673f82748907f927c459c39e739dcb3ebcfc029b3fdd81d7a528cd2a025d01b28ded04a604a6375b13b8ea1
SSDEEP 192:NWnNnAi9HEsjSXOLqaJN5MoiwH7abHG+jR9nsVVI+2ky0C+2c:NWnJ9HaOEoiwH7ab9sVK+2ky0C+2c
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

tzii.myq-see.com:888

Mutex

RV_MUTEX-IUnoWrUUgHRHXJv

Targets

- Target
  acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595.exe
- Size 17KB
- SHA256 acec05fb087440c24b6ac8a15051b8fc7fdfd92bdf458b165e1e19265395b595
- MD5 af48897e401a79baf8086585c18cf8fe
- SHA1 44e9a2699d07cbba45493000287ab5dfbe86df77
- SHA512 c65d348d3225e86909e33e9ef9717be72ea7f934b673f82748907f927c459c39e739dcb3ebcfc029b3fdd81d7a528cd2a025d01b28ded04a604a6375b13b8ea1
- SSDEEP 192:NWnNnAi9HEsjSXOLqaJN5MoiwH7abHG+jR9nsVVI+2ky0C+2c:NWnJ9HaOEoiwH7ab9sVK+2ky0C+2c
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

revengerat stealer trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- RevengeRat Executable
  stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Uses the VBS compiler for execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RevengeRat Executable

Checks computer location settings

Drops startup file

Executes dropped EXE

Uses the VBS compiler for execution

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2