General

  • Target

    1498655cea566732901930bf572ded9b3fb72177472a012ea8254c38845d9d8b.exe

  • Size

    905KB

  • Sample

    241205-ra7dfsxmhy

  • MD5

    04d781c1cdb04d75b58eb057be7909c4

  • SHA1

    739a044cfb7f131bd2c4f7a8844dd43a1bb735f7

  • SHA256

    1498655cea566732901930bf572ded9b3fb72177472a012ea8254c38845d9d8b

  • SHA512

    a3f5ba3a3b8962a3ab6728f7e4109d049d11bc75dd298375b2380b91f5297b5ad7baa2d9d56b6395143110c7f56433a819ac962e8b4ec23f0ffd6cc6dd08dab8

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5T:gh+ZkldoPK8YaKGT

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1498655cea566732901930bf572ded9b3fb72177472a012ea8254c38845d9d8b.exe

    • Size

      905KB

    • MD5

      04d781c1cdb04d75b58eb057be7909c4

    • SHA1

      739a044cfb7f131bd2c4f7a8844dd43a1bb735f7

    • SHA256

      1498655cea566732901930bf572ded9b3fb72177472a012ea8254c38845d9d8b

    • SHA512

      a3f5ba3a3b8962a3ab6728f7e4109d049d11bc75dd298375b2380b91f5297b5ad7baa2d9d56b6395143110c7f56433a819ac962e8b4ec23f0ffd6cc6dd08dab8

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5T:gh+ZkldoPK8YaKGT

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks