General

  • Target

    4d5943f4ec6b8e3843050b2ff52dfbc0N.exe

  • Size

    904KB

  • Sample

    240905-f69b5svdlh

  • MD5

    4d5943f4ec6b8e3843050b2ff52dfbc0

  • SHA1

    342d51849140ce6da208c567d6190b3f797b1be1

  • SHA256

    25182b5534f0c65853b17c3afcd45d375bef3016c5b2e86989d53222973b8e7e

  • SHA512

    95ac648cb6b9a237a4ef97714649ff26ada1dedf953849040e37379c998c39df77239de26767290dbb6c237d6e919db9c14371720419e96181a03bf1682e7a5e

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4d5943f4ec6b8e3843050b2ff52dfbc0N.exe

    • Size

      904KB

    • MD5

      4d5943f4ec6b8e3843050b2ff52dfbc0

    • SHA1

      342d51849140ce6da208c567d6190b3f797b1be1

    • SHA256

      25182b5534f0c65853b17c3afcd45d375bef3016c5b2e86989d53222973b8e7e

    • SHA512

      95ac648cb6b9a237a4ef97714649ff26ada1dedf953849040e37379c998c39df77239de26767290dbb6c237d6e919db9c14371720419e96181a03bf1682e7a5e

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks