Overview

overview

10

Static

static

5

3b1dce057e...0N.exe

windows7-x64

10

3b1dce057e...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b1dce057e1d725d4d2431c1ae43fd00N.exe

  • Size

    903KB

  • Sample

    240720-ctsxvawanf

  • MD5

    3b1dce057e1d725d4d2431c1ae43fd00

  • SHA1

    8bb18bd38939321afa5c06991f67040524f6e3b3

  • SHA256

    32dda413714f0305d922aa4ae95db4fcb14a5c2c7f824346b4b124bd4210fb38

  • SHA512

    d2fe11f0e7605be4089b6bc48c4b094118b7448b9ec70b16ee3bd75fad86770a90a7a73316d9b05c223673ec7c4c6d729bc936e8f57e6294d87863de5ef27c75

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3b1dce057e1d725d4d2431c1ae43fd00N.exe

    • Size

      903KB

    • MD5

      3b1dce057e1d725d4d2431c1ae43fd00

    • SHA1

      8bb18bd38939321afa5c06991f67040524f6e3b3

    • SHA256

      32dda413714f0305d922aa4ae95db4fcb14a5c2c7f824346b4b124bd4210fb38

    • SHA512

      d2fe11f0e7605be4089b6bc48c4b094118b7448b9ec70b16ee3bd75fad86770a90a7a73316d9b05c223673ec7c4c6d729bc936e8f57e6294d87863de5ef27c75

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks