General

  • Target

    881f0fde97e3a94f2f88e4023abc52c03ff1ece316222ff6a69741e6243f6aa3.exe

  • Size

    904KB

  • Sample

    241203-yvhn6a1qdt

  • MD5

    0a8cc78edd78ddf2c5e8ebb9e29b4a34

  • SHA1

    997f653d885dec7e2788d0369e967f86e60ede0c

  • SHA256

    881f0fde97e3a94f2f88e4023abc52c03ff1ece316222ff6a69741e6243f6aa3

  • SHA512

    10e39df53c3354bdf235bbe2bb81af34e94657e95166954954009fd362a9159abc464613d54646d1821a514f6aefe1c454fbcce5cd067d730e126fee81b092bb

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      881f0fde97e3a94f2f88e4023abc52c03ff1ece316222ff6a69741e6243f6aa3.exe

    • Size

      904KB

    • MD5

      0a8cc78edd78ddf2c5e8ebb9e29b4a34

    • SHA1

      997f653d885dec7e2788d0369e967f86e60ede0c

    • SHA256

      881f0fde97e3a94f2f88e4023abc52c03ff1ece316222ff6a69741e6243f6aa3

    • SHA512

      10e39df53c3354bdf235bbe2bb81af34e94657e95166954954009fd362a9159abc464613d54646d1821a514f6aefe1c454fbcce5cd067d730e126fee81b092bb

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks