Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/D...

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://github.com/Da2dalus/The-MALWARE-Repo
  • Sample260211-bx4m3set4c
Score
10/10
revengeratsasserguestaspackv2defense_evasiondiscoverystealertrojanworm

Malware Config

Extracted

Family

  • revengerat

Botnet

  • Guest

C2

  • 0.tcp.ngrok.io:19521

Mutex

  • RV_MUTEX

Targets

    • Target
      https://github.com/Da2dalus/The-MALWARE-Repo
    Score
    10/10
    aspackv2guestdefense_evasiondiscoveryrevengeratsasserstealertrojanworm

    • Detects Sasser

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • Sasser

      Sasser is a Windows worm written in C.

      wormsasser

    • Sasser family

      sasser

    • RevengeRat Executable

      stealer

    • Disables Task Manager via registry modification

      defense_evasion

    • Downloads MZ/PE file

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Drops startup file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks