General

  • Target

    8da3e8519d434141a7a1aecb267cb86d7ae310888e05885c0b096d2bfd96d6e9.exe

  • Size

    904KB

  • Sample

    241204-f2kg8ayqcm

  • MD5

    ec050a2725b63034d24152e55c20d687

  • SHA1

    7b653f58e833d047e44bd216eebcc69e4c49f3e2

  • SHA256

    8da3e8519d434141a7a1aecb267cb86d7ae310888e05885c0b096d2bfd96d6e9

  • SHA512

    efb1923a69ed6fa72af0fd663eb678c7fe59a33a5b84651cb893873012e6bfb7232d68418ae45307da0e2c562d5335fc7f55f7851a9f43e1df0621357c79aff6

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8da3e8519d434141a7a1aecb267cb86d7ae310888e05885c0b096d2bfd96d6e9.exe

    • Size

      904KB

    • MD5

      ec050a2725b63034d24152e55c20d687

    • SHA1

      7b653f58e833d047e44bd216eebcc69e4c49f3e2

    • SHA256

      8da3e8519d434141a7a1aecb267cb86d7ae310888e05885c0b096d2bfd96d6e9

    • SHA512

      efb1923a69ed6fa72af0fd663eb678c7fe59a33a5b84651cb893873012e6bfb7232d68418ae45307da0e2c562d5335fc7f55f7851a9f43e1df0621357c79aff6

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks