General

  • Target

    Client.exe

  • Size

    16KB

  • Sample

    241012-hpga5stbpp

  • MD5

    203da2c862c0594774d5a8d400974128

  • SHA1

    fc16eeaccc9197484254f8b2a2aa559f7613029f

  • SHA256

    6e5dcc76eb40605f27adaba59d0c6e3836c904cb3a3935fd8e3dd22555e027c3

  • SHA512

    7841e998b722201b3ac4b0e885d3fda53f58239feed0f3bb860498efd044e6e8d485d333ff6b1370abeedf24f9212ca345bf445db2790a2363afab26e3cce6e8

  • SSDEEP

    384:SLGXnSVdX5/VBjipD9oDPlMNcLlb5sVKZyN5Ct:SLGXnSVdTBjOclMNESo

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

Pizd11337-26540.portmap.host:26540

Mutex

RV_MUTEX

Targets

    • Target

      Client.exe

    • Size

      16KB

    • MD5

      203da2c862c0594774d5a8d400974128

    • SHA1

      fc16eeaccc9197484254f8b2a2aa559f7613029f

    • SHA256

      6e5dcc76eb40605f27adaba59d0c6e3836c904cb3a3935fd8e3dd22555e027c3

    • SHA512

      7841e998b722201b3ac4b0e885d3fda53f58239feed0f3bb860498efd044e6e8d485d333ff6b1370abeedf24f9212ca345bf445db2790a2363afab26e3cce6e8

    • SSDEEP

      384:SLGXnSVdX5/VBjipD9oDPlMNcLlb5sVKZyN5Ct:SLGXnSVdTBjOclMNESo

    Score
    8/10
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v15

Tasks