revengerat | 8f3cda27b0be3d97f13087516187fc0f0c629804f629f048da096a182d3b1751 | Triage

Sharing

General

Target

58b2eccf155b0803ee298040fc71e99b_JaffaCakes118
Size

501KB
Sample

241018-v7jkfazbqa
MD5

58b2eccf155b0803ee298040fc71e99b
SHA1

cc2e0846fc333ba3b0f1ae59a48db7b46b58f568
SHA256

8f3cda27b0be3d97f13087516187fc0f0c629804f629f048da096a182d3b1751
SHA512

c81a389461f4875aed91608d072ffbb4a6c0a48984e392799cca88a411a520fc48611b6d823fb3705e59c785e7ed718b36a1928d78eb840935e5966feb0feaf1
SSDEEP

12288:69f5EvvxWEVj1Nsw+seJF3upKzp93OOak4wcrsPg4qFk:6nExWujHsw+seJF3upOphOfVrII4t

Score

10^/10

revengerat discovery evasion stealer

Malware Config

Targets

- Target
  
  58b2eccf155b0803ee298040fc71e99b_JaffaCakes118
- Size
  
  501KB
- MD5
  
  58b2eccf155b0803ee298040fc71e99b
- SHA1
  
  cc2e0846fc333ba3b0f1ae59a48db7b46b58f568
- SHA256
  
  8f3cda27b0be3d97f13087516187fc0f0c629804f629f048da096a182d3b1751
- SHA512
  
  c81a389461f4875aed91608d072ffbb4a6c0a48984e392799cca88a411a520fc48611b6d823fb3705e59c785e7ed718b36a1928d78eb840935e5966feb0feaf1
- SSDEEP
  
  12288:69f5EvvxWEVj1Nsw+seJF3upKzp93OOak4wcrsPg4qFk:6nExWujHsw+seJF3upOphOfVrII4t
Score

10^/10

discovery evasion
- Modifies firewall policy service
  evasion
- Loads dropped DLL
- Uses the VBS compiler for execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

stealerrevengerat

behavioral1

discoveryevasion

behavioral2

discoveryevasion