General

  • Target

    c850ead2fbea82ad60fe4248208602c0N.exe

  • Size

    904KB

  • Sample

    240906-j4ld3svhrk

  • MD5

    c850ead2fbea82ad60fe4248208602c0

  • SHA1

    6ccced0687ca2afa68cf66b59ec4dcfbaf9768ad

  • SHA256

    bdeba897bffa038fb03b098889c6a9b2a43e7307386084f56d1dae38d8e19042

  • SHA512

    54e671858f5392347c418fc11a2763ab5f9338f60e6673c80f8a5c6be20e2e5939714518191e12d1b6be13f6c474859c1b1419c1befa68a76f78a56f2c3dea5b

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c850ead2fbea82ad60fe4248208602c0N.exe

    • Size

      904KB

    • MD5

      c850ead2fbea82ad60fe4248208602c0

    • SHA1

      6ccced0687ca2afa68cf66b59ec4dcfbaf9768ad

    • SHA256

      bdeba897bffa038fb03b098889c6a9b2a43e7307386084f56d1dae38d8e19042

    • SHA512

      54e671858f5392347c418fc11a2763ab5f9338f60e6673c80f8a5c6be20e2e5939714518191e12d1b6be13f6c474859c1b1419c1befa68a76f78a56f2c3dea5b

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks