revengerat | 8f148719b6989af6eae45d4e787bd6175e3a2629abe036a5642e42bb1fc27108 | Triage

Sharing

General

Target

8f148719b6989af6eae45d4e787bd6175e3a2629abe036a5642e42bb1fc27108.exe
Size

904KB
Sample

241204-g9q6ea1mdp
MD5

296f8b53a0d28e22215733494b76d995
SHA1

10db48c4e42a102c554854f655e2b7bf861ad2ca
SHA256

8f148719b6989af6eae45d4e787bd6175e3a2629abe036a5642e42bb1fc27108
SHA512

a09ce86b9f0b54a535de5627862cd4699be4ba66c42e91936d5a2e3cca3bc76e19e97665eef3c803a5a0566309b63ff16ec9c7fb732c5f95e70af45c14e75dad
SSDEEP

24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Score

10^/10

revengerat marzo26 discovery trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

- Target
  
  8f148719b6989af6eae45d4e787bd6175e3a2629abe036a5642e42bb1fc27108.exe
- Size
  
  904KB
- MD5
  
  296f8b53a0d28e22215733494b76d995
- SHA1
  
  10db48c4e42a102c554854f655e2b7bf861ad2ca
- SHA256
  
  8f148719b6989af6eae45d4e787bd6175e3a2629abe036a5642e42bb1fc27108
- SHA512
  
  a09ce86b9f0b54a535de5627862cd4699be4ba66c42e91936d5a2e3cca3bc76e19e97665eef3c803a5a0566309b63ff16ec9c7fb732c5f95e70af45c14e75dad
- SSDEEP
  
  24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH
Score

10^/10

revengerat marzo26 discovery trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Revengerat family
  revengerat
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

revengeratmarzo26discoverytrojan

behavioral2

revengeratmarzo26discoverytrojan