General

  • Target

    c8028e17c1716a0c3191a4ac7696c22d2a0891529419f3a2dbf5ac911b5e7928N.exe

  • Size

    904KB

  • Sample

    241203-tyqrqayncq

  • MD5

    07376ed6cadd985448c40cd2440e2b60

  • SHA1

    08334498097b913fb539183f0ef68b21c55ecdbf

  • SHA256

    c8028e17c1716a0c3191a4ac7696c22d2a0891529419f3a2dbf5ac911b5e7928

  • SHA512

    c53dee1c09ca334d7544571d0b885abb70d0fad998c369740f03a7df175c0816b47015e3413e60d54f9c26aa4eb0bd1aabc838de8430d16cd2aed43f1e32e2a9

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c8028e17c1716a0c3191a4ac7696c22d2a0891529419f3a2dbf5ac911b5e7928N.exe

    • Size

      904KB

    • MD5

      07376ed6cadd985448c40cd2440e2b60

    • SHA1

      08334498097b913fb539183f0ef68b21c55ecdbf

    • SHA256

      c8028e17c1716a0c3191a4ac7696c22d2a0891529419f3a2dbf5ac911b5e7928

    • SHA512

      c53dee1c09ca334d7544571d0b885abb70d0fad998c369740f03a7df175c0816b47015e3413e60d54f9c26aa4eb0bd1aabc838de8430d16cd2aed43f1e32e2a9

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks