General

  • Target

    acdf0e1cc4449c91ecc696a4a2b906d0N.exe

  • Size

    904KB

  • Sample

    240909-a8d15awelg

  • MD5

    acdf0e1cc4449c91ecc696a4a2b906d0

  • SHA1

    56fb8bc5dbaa4fe00d7e46f9bdc82c691f5a109c

  • SHA256

    b9855a64394937fb1f92b1718fb2c1fa7630db2864f53ee28192b1c64def17b8

  • SHA512

    1357a22da316291772da3809ebaa4b2d7c39fcb165367c879fdde9e8e8041c12f838e2a4fc1879f76088c0c7deca5182d66cafc1fad582b8ca2e980bbf578f01

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5K:gh+ZkldoPK8YaKGK

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      acdf0e1cc4449c91ecc696a4a2b906d0N.exe

    • Size

      904KB

    • MD5

      acdf0e1cc4449c91ecc696a4a2b906d0

    • SHA1

      56fb8bc5dbaa4fe00d7e46f9bdc82c691f5a109c

    • SHA256

      b9855a64394937fb1f92b1718fb2c1fa7630db2864f53ee28192b1c64def17b8

    • SHA512

      1357a22da316291772da3809ebaa4b2d7c39fcb165367c879fdde9e8e8041c12f838e2a4fc1879f76088c0c7deca5182d66cafc1fad582b8ca2e980bbf578f01

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5K:gh+ZkldoPK8YaKGK

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks