General

  • Target

    NEAS.4fc0afc38e10745042b787aca5057b90.exe

  • Size

    902KB

  • Sample

    231107-zlkb3ahf25

  • MD5

    4fc0afc38e10745042b787aca5057b90

  • SHA1

    d5f95b49f43dff1fd2f0c4a27c087a0385dfe150

  • SHA256

    e71e8af96fbaba4877eb00d444bfac513ef3edba30fadd3e3f90fdab3d23924c

  • SHA512

    813178ae46d5293730e4bf8e62506a499adce848522e8c466982d00715dee65497d37a2d2569e718315b4986cd0aab4d250432470952f21839299c0b56f3298b

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      NEAS.4fc0afc38e10745042b787aca5057b90.exe

    • Size

      902KB

    • MD5

      4fc0afc38e10745042b787aca5057b90

    • SHA1

      d5f95b49f43dff1fd2f0c4a27c087a0385dfe150

    • SHA256

      e71e8af96fbaba4877eb00d444bfac513ef3edba30fadd3e3f90fdab3d23924c

    • SHA512

      813178ae46d5293730e4bf8e62506a499adce848522e8c466982d00715dee65497d37a2d2569e718315b4986cd0aab4d250432470952f21839299c0b56f3298b

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks