General

  • Target

    862e365561df94d7290ed7ef55f5a276de10a715d291e54e33deb73d14d4d80eN.exe

  • Size

    904KB

  • Sample

    241203-yn7ppswqhm

  • MD5

    9fdd51fe9804916929b981c0b0d18b30

  • SHA1

    122fabbf6c89c15865e021a4f202d5a4a26a2f5e

  • SHA256

    862e365561df94d7290ed7ef55f5a276de10a715d291e54e33deb73d14d4d80e

  • SHA512

    b64df4d27d18c58d758b26533422c23098336059869b54f8dbd2b67e586bb264c59e516725876954d32e8cb1a949e1162f21a1c4a72ac60b20e63a63d4a97510

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5d:gh+ZkldoPK8YaKGd

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      862e365561df94d7290ed7ef55f5a276de10a715d291e54e33deb73d14d4d80eN.exe

    • Size

      904KB

    • MD5

      9fdd51fe9804916929b981c0b0d18b30

    • SHA1

      122fabbf6c89c15865e021a4f202d5a4a26a2f5e

    • SHA256

      862e365561df94d7290ed7ef55f5a276de10a715d291e54e33deb73d14d4d80e

    • SHA512

      b64df4d27d18c58d758b26533422c23098336059869b54f8dbd2b67e586bb264c59e516725876954d32e8cb1a949e1162f21a1c4a72ac60b20e63a63d4a97510

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5d:gh+ZkldoPK8YaKGd

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks