General

  • Target

    a49edc62f5bfd961a39ec2a2d6bbb53e4f91ad427c11cfd5ac6bc340da179765N.exe

  • Size

    904KB

  • Sample

    241202-m52dgaxmak

  • MD5

    776eaa6e6fd162c4c65a6db42f952000

  • SHA1

    340e39f807617cccdc1265ae81601a8d46a6b8d6

  • SHA256

    a49edc62f5bfd961a39ec2a2d6bbb53e4f91ad427c11cfd5ac6bc340da179765

  • SHA512

    e080a2385b42c7a4b95905454ec652eb9b9f32abf7fc46254d8c699b725b4b828e1f75c56a0022ec1ee705f18bc833de98e3e78edf87e4cf5d9aaad6cc39ddd4

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a49edc62f5bfd961a39ec2a2d6bbb53e4f91ad427c11cfd5ac6bc340da179765N.exe

    • Size

      904KB

    • MD5

      776eaa6e6fd162c4c65a6db42f952000

    • SHA1

      340e39f807617cccdc1265ae81601a8d46a6b8d6

    • SHA256

      a49edc62f5bfd961a39ec2a2d6bbb53e4f91ad427c11cfd5ac6bc340da179765

    • SHA512

      e080a2385b42c7a4b95905454ec652eb9b9f32abf7fc46254d8c699b725b4b828e1f75c56a0022ec1ee705f18bc833de98e3e78edf87e4cf5d9aaad6cc39ddd4

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa58:gh+ZkldoPK8YaKG8

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks