General

  • Target

    193287005e6a2c3c917cd72f086fb9b15cd97f12a9d53a208a9597312156c945N.exe

  • Size

    904KB

  • Sample

    241203-vxajsa1kcj

  • MD5

    93d2e4e0b3bc9647516fcb69cda50190

  • SHA1

    8e730f97cf1f1850ad4ac18ecdc9526aca0724b0

  • SHA256

    193287005e6a2c3c917cd72f086fb9b15cd97f12a9d53a208a9597312156c945

  • SHA512

    5776e89491dda5ca9b01c8879d5fee2c5c82a7bf8485c19792e97192bde485af27e1b7c287ed71d186fb17a994d8c11cc796a38d0b9a7c7255565335c547ea01

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      193287005e6a2c3c917cd72f086fb9b15cd97f12a9d53a208a9597312156c945N.exe

    • Size

      904KB

    • MD5

      93d2e4e0b3bc9647516fcb69cda50190

    • SHA1

      8e730f97cf1f1850ad4ac18ecdc9526aca0724b0

    • SHA256

      193287005e6a2c3c917cd72f086fb9b15cd97f12a9d53a208a9597312156c945

    • SHA512

      5776e89491dda5ca9b01c8879d5fee2c5c82a7bf8485c19792e97192bde485af27e1b7c287ed71d186fb17a994d8c11cc796a38d0b9a7c7255565335c547ea01

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks