General

  • Target

    1b7a98e8ed515b285b0f84f7d58062b3f9eeaf0089218028a01d6fbf8048b2b1.exe

  • Size

    904KB

  • Sample

    241205-1fklbasqgw

  • MD5

    3a17dc0ba2737d4fdbd21b251ee05828

  • SHA1

    87f1330e843ad92f81c2309f64451c775a98bae6

  • SHA256

    1b7a98e8ed515b285b0f84f7d58062b3f9eeaf0089218028a01d6fbf8048b2b1

  • SHA512

    f198f15325334f2f09866dd1d6af70b63489608c112804488272d1a530ead3336ebc7fefce705bab65c166b63d731d76cf5319b4f71aadcb3b2df97f4eb7619c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1b7a98e8ed515b285b0f84f7d58062b3f9eeaf0089218028a01d6fbf8048b2b1.exe

    • Size

      904KB

    • MD5

      3a17dc0ba2737d4fdbd21b251ee05828

    • SHA1

      87f1330e843ad92f81c2309f64451c775a98bae6

    • SHA256

      1b7a98e8ed515b285b0f84f7d58062b3f9eeaf0089218028a01d6fbf8048b2b1

    • SHA512

      f198f15325334f2f09866dd1d6af70b63489608c112804488272d1a530ead3336ebc7fefce705bab65c166b63d731d76cf5319b4f71aadcb3b2df97f4eb7619c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks