General

  • Target

    43ca3859001288adddae52b2deed9fbd84b72c5a8a9543ce050a0f7957451ec2.exe

  • Size

    904KB

  • Sample

    241205-b4degaxndl

  • MD5

    422266a74cac4475fe211ccc4a9e4eff

  • SHA1

    edbcdd8f4dc1065b68ef7b38e00fc2501bde1a50

  • SHA256

    43ca3859001288adddae52b2deed9fbd84b72c5a8a9543ce050a0f7957451ec2

  • SHA512

    5498d34ba28d0de5a986fb3b44f9dcd10bafe9bff08d769c9fe90c2e9087b294de309450d205b990ded90148fa67715fd9ec62db2041140398603f9ee07aec2c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      43ca3859001288adddae52b2deed9fbd84b72c5a8a9543ce050a0f7957451ec2.exe

    • Size

      904KB

    • MD5

      422266a74cac4475fe211ccc4a9e4eff

    • SHA1

      edbcdd8f4dc1065b68ef7b38e00fc2501bde1a50

    • SHA256

      43ca3859001288adddae52b2deed9fbd84b72c5a8a9543ce050a0f7957451ec2

    • SHA512

      5498d34ba28d0de5a986fb3b44f9dcd10bafe9bff08d769c9fe90c2e9087b294de309450d205b990ded90148fa67715fd9ec62db2041140398603f9ee07aec2c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks