Rewterz Threat Alert – Revenge RAT aka Revetrat – Active IOCs

Severity

Medium

Analysis Summary

First discovered in 2016, Revenge RAT is a remote access trojan (RAT) designed to give an attacker complete control over an infected computer. The malware is typically distributed through phishing emails or exploit kits and once it infects a system, it can steal sensitive information, install additional malware, or even use the machine to launch further attacks.

Revenge RAT uses various techniques to evade detection and analysis, such as code obfuscation and anti-debugging techniques. It also uses a technique called “process injection” to inject its code into legitimate processes and remain hidden from security software.

Once installed, Revenge RAT establishes a connection to its Command and Control (C&C) server, which enables the attacker to remotely control the infected machine and steal sensitive information. The malware can also log keystrokes, capture screenshots, and record audio and video. Revenge RAT can also propagate itself to other machines on the same network, by exploiting known vulnerabilities or weak passwords.

To protect against Revenge RAT, it is important to keep software and operating systems up-to-date, to be cautious when opening emails or clicking on links from unknown sources, and to use security software that can detect and remove RATs. Additionally, using a firewall, disabling unnecessary services and ports, and keeping your network segmented can also help in preventing the spread of malware.

Impact

• Unauthorized Access
• Information Theft

Indicators of Compromise

MD5

• cf5cba1178d7e0ba69f98c39d788a1d0
• 1a0c416ea8f730cd505b29ebd010581a
• 68e748ecf270084cb76a4711a0cd73c1

SHA-256

• 75479b0ad556893c17e01e28f68d369ed87844a5d6d984aa951169799a77799a
• 72c0263a4311ce64fb92a44f12a4d25d6fc4265c6f5f9544f9bebf3475182a38
• ad4d9ff7e21ec275259d9144081c6670dad190dac88321ef7b6fa6e792d4953f

SHA-1

• 6013d0551949d0a20e57e84777a377fee958b111
• e5c3f3d1715d33093be176dcbebdaf5d0d3f7dbf
• 49cc1b7e9e9eb33b4ffbc121011273ff34d944eb

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Do not download documents attached in emails from unknown sources and strictly refrain from enabling macros when the source isn’t reliable.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Patch and upgrade any platforms and software timely and make it into a standard security policy.
• Enforced Access Management Policies.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.