General

  • Target

    044d82bd5d6dc52f992df8830e000583574677e94985e8db69686bb0214f2126.exe

  • Size

    904KB

  • Sample

    241202-188tls1rdk

  • MD5

    23aa8194d6b6dab92e5206341e7b083f

  • SHA1

    d1629a5bd5d711540446f4933a9d175bebd9886b

  • SHA256

    044d82bd5d6dc52f992df8830e000583574677e94985e8db69686bb0214f2126

  • SHA512

    675217222710baa92acdcc4803601b4d1ba1a9a526a856982095803d8826a449afd50ae3499c51f1b4afe0d97f3f196701c0a9337aab0d13af0b037d82f29252

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      044d82bd5d6dc52f992df8830e000583574677e94985e8db69686bb0214f2126.exe

    • Size

      904KB

    • MD5

      23aa8194d6b6dab92e5206341e7b083f

    • SHA1

      d1629a5bd5d711540446f4933a9d175bebd9886b

    • SHA256

      044d82bd5d6dc52f992df8830e000583574677e94985e8db69686bb0214f2126

    • SHA512

      675217222710baa92acdcc4803601b4d1ba1a9a526a856982095803d8826a449afd50ae3499c51f1b4afe0d97f3f196701c0a9337aab0d13af0b037d82f29252

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks