General

  • Target

    a4a1e78e32254ab8e5f4e1fd81928a80N.exe

  • Size

    903KB

  • Sample

    240813-agy7zstcpf

  • MD5

    a4a1e78e32254ab8e5f4e1fd81928a80

  • SHA1

    99886f1a44c0ec8ca1b5898987da7e4d1cf8ee8a

  • SHA256

    f43ac69538997b7e9b55b0abb96b4de3b58a800b91e6f9b375fbfed913cba4fe

  • SHA512

    fd400b57cda19c5c1bf388eec128f4114d9010bc5ad8fc2fd6c82e950adfef872affaf3831f52bf27379fd015517d595db527b3d63d77458fb1846fc47ef0958

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a4a1e78e32254ab8e5f4e1fd81928a80N.exe

    • Size

      903KB

    • MD5

      a4a1e78e32254ab8e5f4e1fd81928a80

    • SHA1

      99886f1a44c0ec8ca1b5898987da7e4d1cf8ee8a

    • SHA256

      f43ac69538997b7e9b55b0abb96b4de3b58a800b91e6f9b375fbfed913cba4fe

    • SHA512

      fd400b57cda19c5c1bf388eec128f4114d9010bc5ad8fc2fd6c82e950adfef872affaf3831f52bf27379fd015517d595db527b3d63d77458fb1846fc47ef0958

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks