General

  • Target

    c6c1a4be331e901b42cd7b0c3a5164737ea4b465dd2f360057161e11fa4de62f.exe

  • Size

    904KB

  • Sample

    241119-dldcvszglr

  • MD5

    9e76bf8fc94e4d73fd71a0c80561beab

  • SHA1

    445c078acea8e70ed19ba8eedbfba795ea095273

  • SHA256

    c6c1a4be331e901b42cd7b0c3a5164737ea4b465dd2f360057161e11fa4de62f

  • SHA512

    da3c5ceaa1416a7fa87e9406c6bad7bfcd017c936e44f255057dfdad4df7444ad8167977e479edf8c95354f9b9b87315dafa35b80c0d8edee446530b5e336c7f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c6c1a4be331e901b42cd7b0c3a5164737ea4b465dd2f360057161e11fa4de62f.exe

    • Size

      904KB

    • MD5

      9e76bf8fc94e4d73fd71a0c80561beab

    • SHA1

      445c078acea8e70ed19ba8eedbfba795ea095273

    • SHA256

      c6c1a4be331e901b42cd7b0c3a5164737ea4b465dd2f360057161e11fa4de62f

    • SHA512

      da3c5ceaa1416a7fa87e9406c6bad7bfcd017c936e44f255057dfdad4df7444ad8167977e479edf8c95354f9b9b87315dafa35b80c0d8edee446530b5e336c7f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks