General

  • Target

    70fc6fd98f6e1cefb89054b20a5187081a0bd57c4615e86e28707f80d3ca501f.exe

  • Size

    904KB

  • Sample

    241201-sh9dfsvjbs

  • MD5

    28f9f6e25ad74526674523f71bd7d7f4

  • SHA1

    49684ac5432df5a4ffe9bab6895481242317def5

  • SHA256

    70fc6fd98f6e1cefb89054b20a5187081a0bd57c4615e86e28707f80d3ca501f

  • SHA512

    4d7847bd771674fba98e26f9fb13f7e3b728bf191915cfadb005590f81aa102d188eae26b9e156d734dc568f72a79565a8b74223952267a633c27dc053a1dc23

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      70fc6fd98f6e1cefb89054b20a5187081a0bd57c4615e86e28707f80d3ca501f.exe

    • Size

      904KB

    • MD5

      28f9f6e25ad74526674523f71bd7d7f4

    • SHA1

      49684ac5432df5a4ffe9bab6895481242317def5

    • SHA256

      70fc6fd98f6e1cefb89054b20a5187081a0bd57c4615e86e28707f80d3ca501f

    • SHA512

      4d7847bd771674fba98e26f9fb13f7e3b728bf191915cfadb005590f81aa102d188eae26b9e156d734dc568f72a79565a8b74223952267a633c27dc053a1dc23

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks