General

  • Target

    cecc8882154ca199d170f46b3ca221e27f416257866c72dac47344350d21af6c.exe

  • Size

    904KB

  • Sample

    241203-mww3dssjex

  • MD5

    6fe9d9e13ba87e19210a0aa1aa89bc68

  • SHA1

    c29be135f8799689ce6079162445d2ef3919b475

  • SHA256

    cecc8882154ca199d170f46b3ca221e27f416257866c72dac47344350d21af6c

  • SHA512

    1f9549ecbf4e3f39d0c0d6fa5bc699e7a9563405d858857a23fe09cd34296f0b82edbe147600c741dd864b84f3de9773b497c9ec64c29e7a01343f1294bbac2d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      cecc8882154ca199d170f46b3ca221e27f416257866c72dac47344350d21af6c.exe

    • Size

      904KB

    • MD5

      6fe9d9e13ba87e19210a0aa1aa89bc68

    • SHA1

      c29be135f8799689ce6079162445d2ef3919b475

    • SHA256

      cecc8882154ca199d170f46b3ca221e27f416257866c72dac47344350d21af6c

    • SHA512

      1f9549ecbf4e3f39d0c0d6fa5bc699e7a9563405d858857a23fe09cd34296f0b82edbe147600c741dd864b84f3de9773b497c9ec64c29e7a01343f1294bbac2d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks