Overview

overview

10

Static

static

1

2024-10-31...er.exe

windows7-x64

10

2024-10-31...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader

  • Size

    324KB

  • Sample

    241031-b7bp2swhlb

  • MD5

    8987cdb78358227903ac805abf0b7e29

  • SHA1

    27a75f960fe463e2e8cd462a338786ead98b9fef

  • SHA256

    64e3b5bc412e502c4aea2ff4fba56e9b575a5de09b3c7130015ce37e329a5739

  • SHA512

    57ae471fa454542f04a1b181223e4b6f17b4003b9b3fbbe2ad0a8a152a5a8bfaa9999c951a7351db6a7ca7ec623f41bcc13e99a6e051908ff4cd2dec81506eef

  • SSDEEP

    3072:J0bsJI99LGBLmjiWOZQvlt2OuDaH9vQH8AFbtTjjJjdRpFxzu2l+Rp9542M+lmsf:bqjix7xmOH8E9JzwRxO+lDAAt

Score
10/10
revengeratspamdiscoverytrojan

Malware Config

Extracted

Family

revengerat

Botnet

SPAM

C2

kilimanjaro.cloudns.nz:8809

kilimanjaro.run.place:8809

kilimanjaro.crabdance.com:8809

kilimanjaro.bigmoney.biz:8809

kilimanjaro.theworkpc.com:8809

burkinafaso.duckdns.org:8809
Mutex

RV_MUTEX-GYuaWVCGnhpCsG

Targets

    • Target

      2024-10-31_8987cdb78358227903ac805abf0b7e29_hiddentear_hijackloader

    • Size

      324KB

    • MD5

      8987cdb78358227903ac805abf0b7e29

    • SHA1

      27a75f960fe463e2e8cd462a338786ead98b9fef

    • SHA256

      64e3b5bc412e502c4aea2ff4fba56e9b575a5de09b3c7130015ce37e329a5739

    • SHA512

      57ae471fa454542f04a1b181223e4b6f17b4003b9b3fbbe2ad0a8a152a5a8bfaa9999c951a7351db6a7ca7ec623f41bcc13e99a6e051908ff4cd2dec81506eef

    • SSDEEP

      3072:J0bsJI99LGBLmjiWOZQvlt2OuDaH9vQH8AFbtTjjJjdRpFxzu2l+Rp9542M+lmsf:bqjix7xmOH8E9JzwRxO+lDAAt

    Score
    10/10
    revengeratspamdiscoverytrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks