General

  • Target

    4aed340fcde3602287fb6a9668b7e660N.exe

  • Size

    904KB

  • Sample

    240823-m8cvaashlp

  • MD5

    4aed340fcde3602287fb6a9668b7e660

  • SHA1

    48ae2c8f1b5e5477a297c6300440f3f246f17752

  • SHA256

    9f24308e249749e356e0cd3ba999737c9e085d889a0873abd16ec0ff7bb9c181

  • SHA512

    5d493bd3e07a34edfcdb8864b7effbdfd289b2ebeb61e26ce9eeba6143656d4ed766e52651fbefc668dffa851355e17e58e79c75fb656a7540d0ec892701f88a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4aed340fcde3602287fb6a9668b7e660N.exe

    • Size

      904KB

    • MD5

      4aed340fcde3602287fb6a9668b7e660

    • SHA1

      48ae2c8f1b5e5477a297c6300440f3f246f17752

    • SHA256

      9f24308e249749e356e0cd3ba999737c9e085d889a0873abd16ec0ff7bb9c181

    • SHA512

      5d493bd3e07a34edfcdb8864b7effbdfd289b2ebeb61e26ce9eeba6143656d4ed766e52651fbefc668dffa851355e17e58e79c75fb656a7540d0ec892701f88a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks