General

  • Target

    df9a815610a7c55501b71216488a4af69c2e55410d5cea1eaa5d1ed2b5903760N.exe

  • Size

    904KB

  • Sample

    241203-ljbegsvmdj

  • MD5

    a3f4a7bec933777543f04107426ce260

  • SHA1

    26053b96ad30f94fd106fd2816d0871c24a7103e

  • SHA256

    df9a815610a7c55501b71216488a4af69c2e55410d5cea1eaa5d1ed2b5903760

  • SHA512

    8d2e5df9333abd499e1ea837f2ee64ec28614aafd2d64b8316a4a86256c341686ff646457131a716d1770b9397f6fcd3231a91486e7b758fb1babdea6ac75101

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      df9a815610a7c55501b71216488a4af69c2e55410d5cea1eaa5d1ed2b5903760N.exe

    • Size

      904KB

    • MD5

      a3f4a7bec933777543f04107426ce260

    • SHA1

      26053b96ad30f94fd106fd2816d0871c24a7103e

    • SHA256

      df9a815610a7c55501b71216488a4af69c2e55410d5cea1eaa5d1ed2b5903760

    • SHA512

      8d2e5df9333abd499e1ea837f2ee64ec28614aafd2d64b8316a4a86256c341686ff646457131a716d1770b9397f6fcd3231a91486e7b758fb1babdea6ac75101

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks