Overview

overview

10

Static

static

3

svchost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    527KB

  • Sample

    250404-ya6kgsvqz5

  • MD5

    8d8406efe453f31827c13ceb7c939754

  • SHA1

    d21d889ce740d27ffe06b41940476a4a436dd3ec

  • SHA256

    697585670f658c4a97b8ffba1f251db024967c345a012aa3c09f64fbe291ba9c

  • SHA512

    2a8eb89c7bdc898002909445838d6016fbf6fc7f95d15996468d681e3c32b8c1abe42a0d91ef79c9374da7c01c0795d40eafbedd48e927137c6788d88338472d

  • SSDEEP

    6144:c9lbcrJZ/FlpsvfO8UabGbjWVCxoCh+6I1fhoYS8ucrXGIAbbILChnSPdK0yyyIC:g+hsxUEN1CMzoC1gJadSHIaRy2Z

Score
10/10
revengeratumbralxwormexecutionratstealertrojan

Malware Config

Targets

    • Target

      svchost.exe

    • Size

      527KB

    • MD5

      8d8406efe453f31827c13ceb7c939754

    • SHA1

      d21d889ce740d27ffe06b41940476a4a436dd3ec

    • SHA256

      697585670f658c4a97b8ffba1f251db024967c345a012aa3c09f64fbe291ba9c

    • SHA512

      2a8eb89c7bdc898002909445838d6016fbf6fc7f95d15996468d681e3c32b8c1abe42a0d91ef79c9374da7c01c0795d40eafbedd48e927137c6788d88338472d

    • SSDEEP

      6144:c9lbcrJZ/FlpsvfO8UabGbjWVCxoCh+6I1fhoYS8ucrXGIAbbILChnSPdK0yyyIC:g+hsxUEN1CMzoC1gJadSHIaRy2Z

    Score
    10/10
    revengeratumbralxwormexecutionratstealertrojan

    • Detect Umbral payload

    • Detect Xworm Payload

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral

    • Umbral family

      umbral

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • RevengeRat Executable

      stealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks