Overview

overview

10

Static

static

5

491f7eb359...7e.exe

windows7-x64

10

491f7eb359...7e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cacfd0e2d423ae0f7ad637c971bd591d.bin

  • Size

    471KB

  • Sample

    240830-cbzbxa1gmg

  • MD5

    14eeef898ac04613bee1288ea7f130dd

  • SHA1

    059f25df497f84ac7b788a18240e1fe921c2f488

  • SHA256

    2d67b312629d42214726e0755ecce0ad48789904f1334029b9b7cbc004b8796a

  • SHA512

    0dbf05661050ae6440fb5700c74b094afdd38e8480473604b34c1add7517c693029d5ae9bf22a3f1a22d75b477027a50745f8d64cb8e1c1ca3f2cb98f45def6c

  • SSDEEP

    12288:30ozuUGc7OG8K5FSbhBAylynVxZM6/E5lBC7+Xj:30YPXiGkGrg9z

Score
10/10
revengeratmarzo26discoverytrojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      491f7eb35995a90505019c995e9bcd29d75167f8770e74747893807f420b107e.exe

    • Size

      904KB

    • MD5

      cacfd0e2d423ae0f7ad637c971bd591d

    • SHA1

      c98f4026b1bb1df65ebcdbbe74e37f8138f6efe7

    • SHA256

      491f7eb35995a90505019c995e9bcd29d75167f8770e74747893807f420b107e

    • SHA512

      1b315b10a254bcb36877379f9c8f8705be34e981d4d67a0a5a2fcccf181b7c6e1520d5da522883da06f86130732b02837cd945333cf4ccee25300a1c65537fbd

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ

    Score
    10/10
    revengeratmarzo26discoverytrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks