General

  • Target

    Revenge-RAT v0.3.7z

  • Size

    8.7MB

  • Sample

    250312-zdyjqastgw

  • MD5

    3864072888fd4bc4f3c67333ecde70c7

  • SHA1

    7982d4baabbea5f4fee4fefc2632d5535f433b35

  • SHA256

    b39d78411da6390a7df0f37b908dbb1b9089abd558b9e06ee852a11fc77d7251

  • SHA512

    89f13697f43680bce715ee98c98f84a56f2c2707c77a0e7a59804c46cb89a091ce213e6c98f7c264539f4634079898dbb91030e31a704f2f48161f355ef35f80

  • SSDEEP

    196608:8hwcP7zWP5126X1CfXWcyeWWJmGr0N08mQABgYQi+maA:DcPns281CucZRmGr0NvmbD6mB

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

127.0.0.1:4782

Mutex

RV_MUTEX

Targets

    • Target

      Revenge-RAT v0.3.7z

    • Size

      8.7MB

    • MD5

      3864072888fd4bc4f3c67333ecde70c7

    • SHA1

      7982d4baabbea5f4fee4fefc2632d5535f433b35

    • SHA256

      b39d78411da6390a7df0f37b908dbb1b9089abd558b9e06ee852a11fc77d7251

    • SHA512

      89f13697f43680bce715ee98c98f84a56f2c2707c77a0e7a59804c46cb89a091ce213e6c98f7c264539f4634079898dbb91030e31a704f2f48161f355ef35f80

    • SSDEEP

      196608:8hwcP7zWP5126X1CfXWcyeWWJmGr0N08mQABgYQi+maA:DcPns281CucZRmGr0NvmbD6mB

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • RevengeRat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks