General

  • Target

    NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe

  • Size

    902KB

  • Sample

    231103-wembasff5t

  • MD5

    875a806f3b37f0268e47db10e410a761

  • SHA1

    2408b526db41cad7cff345aa5753476147f8f0b4

  • SHA256

    0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700

  • SHA512

    4c057f8edcb2fc4c8b96a990cc716b38fb860fb1a49689be2af38df2d0a81e4af92387e322fe51da0f95f13f07b88f6d8d71f788e7b07b7fd5d05a26b009b831

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      NEAS.0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700exe_JC.exe

    • Size

      902KB

    • MD5

      875a806f3b37f0268e47db10e410a761

    • SHA1

      2408b526db41cad7cff345aa5753476147f8f0b4

    • SHA256

      0b4cbe7838d5c2e166b446a2fdf63fec79e033c4ced7eb5cc60431b8f22e6700

    • SHA512

      4c057f8edcb2fc4c8b96a990cc716b38fb860fb1a49689be2af38df2d0a81e4af92387e322fe51da0f95f13f07b88f6d8d71f788e7b07b7fd5d05a26b009b831

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks