General

  • Target

    6019f803387f96436bc40174f153f520N.exe

  • Size

    904KB

  • Sample

    240822-eepyra1apn

  • MD5

    6019f803387f96436bc40174f153f520

  • SHA1

    49d6a28564de0ecde817d81e1348ff91499564f3

  • SHA256

    15338a5fb6a2deeede04635aebb26c7aebbae80872a005d2ee6a2de1d92912f7

  • SHA512

    91ed497a7aefa227ca4beac384a533120ad4e311ff7eea0c69e7abeb0463bef1da359630b5d15b1879e49b85fcb7437deffafda5e28ae72e382021e651ddb0b8

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6019f803387f96436bc40174f153f520N.exe

    • Size

      904KB

    • MD5

      6019f803387f96436bc40174f153f520

    • SHA1

      49d6a28564de0ecde817d81e1348ff91499564f3

    • SHA256

      15338a5fb6a2deeede04635aebb26c7aebbae80872a005d2ee6a2de1d92912f7

    • SHA512

      91ed497a7aefa227ca4beac384a533120ad4e311ff7eea0c69e7abeb0463bef1da359630b5d15b1879e49b85fcb7437deffafda5e28ae72e382021e651ddb0b8

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks