Resubmissions

17-11-2024 21:17

241117-z44hnatjgq 10

17-11-2024 20:18

241117-y3c4msxgmn 10

General

  • Target

    1bacbeb5f98d78a72cae4bc3dee1dfe903300ee85bf53a92db7e8a28f4eaf0e3N.exe

  • Size

    904KB

  • Sample

    241117-z44hnatjgq

  • MD5

    cbcab9b882f24b35dfad95930817eab0

  • SHA1

    b314ae0ab0adc2e87f8296a0be94913724e5f9cc

  • SHA256

    1bacbeb5f98d78a72cae4bc3dee1dfe903300ee85bf53a92db7e8a28f4eaf0e3

  • SHA512

    d168d460b9c554b4fc7a2314dd4df9bfc6e5d08d86bba751025d1611e807310c049211630ea424c27c89a587b973e57070b2e103ff8c8ce92c3277d1358109db

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5w:gh+ZkldoPK8YaKGw

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1bacbeb5f98d78a72cae4bc3dee1dfe903300ee85bf53a92db7e8a28f4eaf0e3N.exe

    • Size

      904KB

    • MD5

      cbcab9b882f24b35dfad95930817eab0

    • SHA1

      b314ae0ab0adc2e87f8296a0be94913724e5f9cc

    • SHA256

      1bacbeb5f98d78a72cae4bc3dee1dfe903300ee85bf53a92db7e8a28f4eaf0e3

    • SHA512

      d168d460b9c554b4fc7a2314dd4df9bfc6e5d08d86bba751025d1611e807310c049211630ea424c27c89a587b973e57070b2e103ff8c8ce92c3277d1358109db

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5w:gh+ZkldoPK8YaKGw

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks