General

  • Target

    9a2fcf99caf8e8b9a55fba73084d0f046321e8792af64086adee16699be60e10.exe

  • Size

    904KB

  • Sample

    241203-cfr4dstqfv

  • MD5

    6b7a54b555ea343ce5967097e07c9f9d

  • SHA1

    74c966fb1986beb76b4fd1bd96399d5c4174fddf

  • SHA256

    9a2fcf99caf8e8b9a55fba73084d0f046321e8792af64086adee16699be60e10

  • SHA512

    8685326c28128fba67fbbc0b7d1efe64da68f266b4e25370ebf83cbf8898472826b11aa3b7d4485eb46d475cbd8d0c70ba9e60f81435f3a9388ee2ddb4653041

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5L:gh+ZkldoPK8YaKGL

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9a2fcf99caf8e8b9a55fba73084d0f046321e8792af64086adee16699be60e10.exe

    • Size

      904KB

    • MD5

      6b7a54b555ea343ce5967097e07c9f9d

    • SHA1

      74c966fb1986beb76b4fd1bd96399d5c4174fddf

    • SHA256

      9a2fcf99caf8e8b9a55fba73084d0f046321e8792af64086adee16699be60e10

    • SHA512

      8685326c28128fba67fbbc0b7d1efe64da68f266b4e25370ebf83cbf8898472826b11aa3b7d4485eb46d475cbd8d0c70ba9e60f81435f3a9388ee2ddb4653041

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5L:gh+ZkldoPK8YaKGL

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks