General

  • Target

    81f2af812f29d6c66d329b3eb02b57d0N.exe

  • Size

    904KB

  • Sample

    240825-lx49qaxhnf

  • MD5

    81f2af812f29d6c66d329b3eb02b57d0

  • SHA1

    5ffcb9c04e60e4b0190b4bed6dde0a5156c40fbf

  • SHA256

    b82ac57b24f7ae56955815479c737e848f1a390ce1c3f7bfc0b5d43d913a5c40

  • SHA512

    dd1f21141fa9bc7ca50a2858a130c8b45628d2bca40a245734baf426e1401aaee3d59b312c04473f22fdcf5ba32699732f4ec2968324025726e9270c3427f45d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5k:gh+ZkldoPK8YaKGk

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      81f2af812f29d6c66d329b3eb02b57d0N.exe

    • Size

      904KB

    • MD5

      81f2af812f29d6c66d329b3eb02b57d0

    • SHA1

      5ffcb9c04e60e4b0190b4bed6dde0a5156c40fbf

    • SHA256

      b82ac57b24f7ae56955815479c737e848f1a390ce1c3f7bfc0b5d43d913a5c40

    • SHA512

      dd1f21141fa9bc7ca50a2858a130c8b45628d2bca40a245734baf426e1401aaee3d59b312c04473f22fdcf5ba32699732f4ec2968324025726e9270c3427f45d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5k:gh+ZkldoPK8YaKGk

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks