General

  • Target

    b9c042abd362dddca921736176143afed0e3a1d331e32fcd26a2f8725386627c.exe

  • Size

    904KB

  • Sample

    241119-cj9slsyngv

  • MD5

    6ddf2bf221968dcac94f75c6cdaf59d4

  • SHA1

    d590b3e568491bfc61dbfd9224bd76380fc8222f

  • SHA256

    b9c042abd362dddca921736176143afed0e3a1d331e32fcd26a2f8725386627c

  • SHA512

    2f8c82dac21e1d157e597c31190b1ff62bcb0f43a3726e445b7b48d9a114bc87c2dc3a00fe0dd46405b588e4ca8d56354f55c79c6fb7703e45b9658b5220e6a2

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b9c042abd362dddca921736176143afed0e3a1d331e32fcd26a2f8725386627c.exe

    • Size

      904KB

    • MD5

      6ddf2bf221968dcac94f75c6cdaf59d4

    • SHA1

      d590b3e568491bfc61dbfd9224bd76380fc8222f

    • SHA256

      b9c042abd362dddca921736176143afed0e3a1d331e32fcd26a2f8725386627c

    • SHA512

      2f8c82dac21e1d157e597c31190b1ff62bcb0f43a3726e445b7b48d9a114bc87c2dc3a00fe0dd46405b588e4ca8d56354f55c79c6fb7703e45b9658b5220e6a2

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks