General

  • Target

    b81565fb3fa5e657915f9cf4d8ba42b1dea441868f7316a91b06bbc1dd12e708N.exe

  • Size

    904KB

  • Sample

    241118-qe316axfmn

  • MD5

    631006c8c57f155072ad7a043cd6c730

  • SHA1

    5c6cbf725d70f15f54de1ef85627a2c53a6283a9

  • SHA256

    b81565fb3fa5e657915f9cf4d8ba42b1dea441868f7316a91b06bbc1dd12e708

  • SHA512

    05635e5cc9b97eacd39badf768a9286e680b0d8f3ab993898b8b8087dcb4029ea7f46ae84fa196f1a46e1b45e05d8f7b840b4e0485880c2f563b88d2fa0e7480

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b81565fb3fa5e657915f9cf4d8ba42b1dea441868f7316a91b06bbc1dd12e708N.exe

    • Size

      904KB

    • MD5

      631006c8c57f155072ad7a043cd6c730

    • SHA1

      5c6cbf725d70f15f54de1ef85627a2c53a6283a9

    • SHA256

      b81565fb3fa5e657915f9cf4d8ba42b1dea441868f7316a91b06bbc1dd12e708

    • SHA512

      05635e5cc9b97eacd39badf768a9286e680b0d8f3ab993898b8b8087dcb4029ea7f46ae84fa196f1a46e1b45e05d8f7b840b4e0485880c2f563b88d2fa0e7480

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks