General

  • Target

    2e01fa06fd0a8972e663d11e2aa027e380155b8d2d8866640cf26fd7271d338bN.exe

  • Size

    904KB

  • Sample

    241130-g3ffbswqfs

  • MD5

    e8273633b17c6677fbff0cfa78992660

  • SHA1

    245b2051347449e9ad0970a70be024ad0a438b27

  • SHA256

    2e01fa06fd0a8972e663d11e2aa027e380155b8d2d8866640cf26fd7271d338b

  • SHA512

    bcd3e681893dee781eb3e9d21adbd3fb375b5337bf44ee96155b715300bea001ad1cac2715a2414e3cd9267ab54b07f5f35c0e4fc0c8c481bbdbaa0082434bac

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2e01fa06fd0a8972e663d11e2aa027e380155b8d2d8866640cf26fd7271d338bN.exe

    • Size

      904KB

    • MD5

      e8273633b17c6677fbff0cfa78992660

    • SHA1

      245b2051347449e9ad0970a70be024ad0a438b27

    • SHA256

      2e01fa06fd0a8972e663d11e2aa027e380155b8d2d8866640cf26fd7271d338b

    • SHA512

      bcd3e681893dee781eb3e9d21adbd3fb375b5337bf44ee96155b715300bea001ad1cac2715a2414e3cd9267ab54b07f5f35c0e4fc0c8c481bbdbaa0082434bac

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks