General

  • Target

    87b512dd91b4cad6ee7bd227bdf0d0a38182e8a48357022032483f272c2e13c8.exe

  • Size

    904KB

  • Sample

    241203-t1yv4sypcj

  • MD5

    24fabb964475da85aabc8a8b5463433b

  • SHA1

    f7bf374ba2d766529db65528be167d6bf4ac59db

  • SHA256

    87b512dd91b4cad6ee7bd227bdf0d0a38182e8a48357022032483f272c2e13c8

  • SHA512

    e786992c50f8047ce16c802c0300b491b2a6fedced79736c21935a392cc1be53cf80249923fd385e88fa242781b402e859d7ac8b91789bd5f0f7e5b81b862857

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      87b512dd91b4cad6ee7bd227bdf0d0a38182e8a48357022032483f272c2e13c8.exe

    • Size

      904KB

    • MD5

      24fabb964475da85aabc8a8b5463433b

    • SHA1

      f7bf374ba2d766529db65528be167d6bf4ac59db

    • SHA256

      87b512dd91b4cad6ee7bd227bdf0d0a38182e8a48357022032483f272c2e13c8

    • SHA512

      e786992c50f8047ce16c802c0300b491b2a6fedced79736c21935a392cc1be53cf80249923fd385e88fa242781b402e859d7ac8b91789bd5f0f7e5b81b862857

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks