revengerat | 8038a88e50da9b4d4e168e6cf4151440e0864fdb5c27f0fbb21ee0e71834b80d | Triage

Sharing

General

Target

21f9aa4b8e01f8b6f9421cf41d01caa2.bin
Size

471KB
Sample

241018-bg4m5sxclb
MD5

4ce6a2d7446b46a9865a8049198dfe46
SHA1

e79326852d81cba180c0e500ea7b57f067608e26
SHA256

8038a88e50da9b4d4e168e6cf4151440e0864fdb5c27f0fbb21ee0e71834b80d
SHA512

32fed332dae07decc4617667f682cdf40520f173339c4ace8080f100ecb3054ab74eed77f43c01ff6711380c27d3cfe0c1ecd2e17453484e5c0b67294a0d290a
SSDEEP

12288:NIDPgnr5cjaPtoReP4J94JWaEzG36U5mz:ay6UP4JqJhSG36U5k

Score

10^/10

revengerat marzo26 discovery trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

- Target
  
  e5e78b90dfa67c5ce67d5d271bdcd59d55aef53625660adc3564414a30f8047d.exe
- Size
  
  904KB
- MD5
  
  21f9aa4b8e01f8b6f9421cf41d01caa2
- SHA1
  
  f92a495936aa1b32a1d7224f0606520242d1c62b
- SHA256
  
  e5e78b90dfa67c5ce67d5d271bdcd59d55aef53625660adc3564414a30f8047d
- SHA512
  
  9cf0e79f8dd5d407e6a46306ae6cd8388fa662b972bbfaf1f04964068b2fc1b1f419e7be9c31f450f0c9ec1fb6ec5eabd2f2a641b1892a2b19ad158bf3251a44
- SSDEEP
  
  24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX
Score

10^/10

revengerat marzo26 discovery trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

revengeratmarzo26discoverytrojan

behavioral2

revengeratmarzo26discoverytrojan