General

  • Target

    9d81b1bec5ebce1374c0cb4668c6f120N.exe

  • Size

    903KB

  • Sample

    240814-l8brjs1erp

  • MD5

    9d81b1bec5ebce1374c0cb4668c6f120

  • SHA1

    6c21ebdfd34d1821eb93181179fcedcef7e105f1

  • SHA256

    b0602cc9f92c9138a34f0e99a9f2017f56628e997657b2f998dedf83af2461e6

  • SHA512

    6c86b7c4e7a541c70bf21506cc85cfd7ffbff59f501fe25283591992c88635c7ef209f50b092653fd9713343f116e0a6add21410442a41036161869ac92f5c8c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9d81b1bec5ebce1374c0cb4668c6f120N.exe

    • Size

      903KB

    • MD5

      9d81b1bec5ebce1374c0cb4668c6f120

    • SHA1

      6c21ebdfd34d1821eb93181179fcedcef7e105f1

    • SHA256

      b0602cc9f92c9138a34f0e99a9f2017f56628e997657b2f998dedf83af2461e6

    • SHA512

      6c86b7c4e7a541c70bf21506cc85cfd7ffbff59f501fe25283591992c88635c7ef209f50b092653fd9713343f116e0a6add21410442a41036161869ac92f5c8c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks