General

  • Target

    a44819c00a56bfe37923f5019269430c86821f03e1fc3e7a4163871dba41c9bd.exe

  • Size

    904KB

  • Sample

    241203-lvk33avrbm

  • MD5

    6afa0d6183c60c6a9193cf00d89ee6fd

  • SHA1

    be00bee3d8d7751575ac099307102ed5d28fe6d3

  • SHA256

    a44819c00a56bfe37923f5019269430c86821f03e1fc3e7a4163871dba41c9bd

  • SHA512

    2f2f57ba50fa1d7738748ffeaf166bec1eb3e2da1973c5ae8b28ca063bed409bee3fe23759c4c599be64c01953ef5353ecbbbbc421692d18f81cde2a7dbf46d3

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a44819c00a56bfe37923f5019269430c86821f03e1fc3e7a4163871dba41c9bd.exe

    • Size

      904KB

    • MD5

      6afa0d6183c60c6a9193cf00d89ee6fd

    • SHA1

      be00bee3d8d7751575ac099307102ed5d28fe6d3

    • SHA256

      a44819c00a56bfe37923f5019269430c86821f03e1fc3e7a4163871dba41c9bd

    • SHA512

      2f2f57ba50fa1d7738748ffeaf166bec1eb3e2da1973c5ae8b28ca063bed409bee3fe23759c4c599be64c01953ef5353ecbbbbc421692d18f81cde2a7dbf46d3

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks