General

  • Target

    867b77c8842a6fa6ffc69bfd0ae0cee0N.exe

  • Size

    904KB

  • Sample

    240915-jmha4ashjg

  • MD5

    867b77c8842a6fa6ffc69bfd0ae0cee0

  • SHA1

    dbdef9ff6cf541393a5c3f34f3da2ec7ac09ff73

  • SHA256

    c603ab52d964cabdd1710910b9eb3866e1f5f2562c0b7b32fd2450c1de3a5e8b

  • SHA512

    d581f462d227548d74f9c53ad9f27d5de76abbb9d451b65e58a8049528b910f3034ffa96ef9c398005cb6909dff59196b4926ef4fd8d1d2e1134cdf0ad3c1bb9

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      867b77c8842a6fa6ffc69bfd0ae0cee0N.exe

    • Size

      904KB

    • MD5

      867b77c8842a6fa6ffc69bfd0ae0cee0

    • SHA1

      dbdef9ff6cf541393a5c3f34f3da2ec7ac09ff73

    • SHA256

      c603ab52d964cabdd1710910b9eb3866e1f5f2562c0b7b32fd2450c1de3a5e8b

    • SHA512

      d581f462d227548d74f9c53ad9f27d5de76abbb9d451b65e58a8049528b910f3034ffa96ef9c398005cb6909dff59196b4926ef4fd8d1d2e1134cdf0ad3c1bb9

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks