General

  • Target

    7f3c437c7012ac278d48dea37748e0aa43fa26d155b1d4661973e9ff019a1d75.exe

  • Size

    904KB

  • Sample

    241119-nfrneavmhw

  • MD5

    3727a49dcc060a8459cc6099acc8b40e

  • SHA1

    3980dadb6deb137fcf377fc5d5b4296988283d0e

  • SHA256

    7f3c437c7012ac278d48dea37748e0aa43fa26d155b1d4661973e9ff019a1d75

  • SHA512

    81dfa3b69a65b9140e2ddb0d5f272f30d34c97ffc94590e3a7a378c6ee01304b685e9f4c6094faead3c856a352cbc1c79887959c16be808732e204ae39c1011a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      7f3c437c7012ac278d48dea37748e0aa43fa26d155b1d4661973e9ff019a1d75.exe

    • Size

      904KB

    • MD5

      3727a49dcc060a8459cc6099acc8b40e

    • SHA1

      3980dadb6deb137fcf377fc5d5b4296988283d0e

    • SHA256

      7f3c437c7012ac278d48dea37748e0aa43fa26d155b1d4661973e9ff019a1d75

    • SHA512

      81dfa3b69a65b9140e2ddb0d5f272f30d34c97ffc94590e3a7a378c6ee01304b685e9f4c6094faead3c856a352cbc1c79887959c16be808732e204ae39c1011a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks