General

  • Target

    3298dfa5044310a5d9705638ee0f3119353cae51b6c731b028af1acb9b40dbaaN.exe

  • Size

    904KB

  • Sample

    241130-tzremsspfq

  • MD5

    67bd0a689e2df3beb1ca49dda41cd840

  • SHA1

    eefc88acf0e3ade033645d95416f6aa80b1dde64

  • SHA256

    3298dfa5044310a5d9705638ee0f3119353cae51b6c731b028af1acb9b40dbaa

  • SHA512

    72fff426461d01ea1c60c44ef58dfc2ad92be2e9bbe48087150c0230c8462d82f780fa95387351e44a7001af0249ed09797baa35e545d3f30ac171037b3d65ee

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3298dfa5044310a5d9705638ee0f3119353cae51b6c731b028af1acb9b40dbaaN.exe

    • Size

      904KB

    • MD5

      67bd0a689e2df3beb1ca49dda41cd840

    • SHA1

      eefc88acf0e3ade033645d95416f6aa80b1dde64

    • SHA256

      3298dfa5044310a5d9705638ee0f3119353cae51b6c731b028af1acb9b40dbaa

    • SHA512

      72fff426461d01ea1c60c44ef58dfc2ad92be2e9bbe48087150c0230c8462d82f780fa95387351e44a7001af0249ed09797baa35e545d3f30ac171037b3d65ee

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks