General

  • Target

    f420eda3d3d6ffd52e76e5bdd6f57e9e20c6c2b0b8438bfb37fdad59d9137da4N.exe

  • Size

    904KB

  • Sample

    241202-3pahtavlhm

  • MD5

    12366657718f262f74a855f9ce19b1d0

  • SHA1

    07d8143a167c74d81af60c9272ad80845d43a6c4

  • SHA256

    f420eda3d3d6ffd52e76e5bdd6f57e9e20c6c2b0b8438bfb37fdad59d9137da4

  • SHA512

    4e41b996cbc2d586ad4558673d8300b0c8971a84858512430717a3b80920d6b71ed87a7a67e5719254a6fdcb0afc75cb07037d3883be51d9d6350b39ef7add3e

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f420eda3d3d6ffd52e76e5bdd6f57e9e20c6c2b0b8438bfb37fdad59d9137da4N.exe

    • Size

      904KB

    • MD5

      12366657718f262f74a855f9ce19b1d0

    • SHA1

      07d8143a167c74d81af60c9272ad80845d43a6c4

    • SHA256

      f420eda3d3d6ffd52e76e5bdd6f57e9e20c6c2b0b8438bfb37fdad59d9137da4

    • SHA512

      4e41b996cbc2d586ad4558673d8300b0c8971a84858512430717a3b80920d6b71ed87a7a67e5719254a6fdcb0afc75cb07037d3883be51d9d6350b39ef7add3e

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks