General

  • Target

    3b5fdadf8fffda01b256bbe982f54f01648fb9732c9f41f99f7d9dfe7d58ecfb.exe

  • Size

    904KB

  • Sample

    241205-vvpkxszpfk

  • MD5

    1dcc4862b7df3dc9ed3d87a97ad0c3c0

  • SHA1

    f11a4a029a103c554fd987b76f7fd0467543389b

  • SHA256

    3b5fdadf8fffda01b256bbe982f54f01648fb9732c9f41f99f7d9dfe7d58ecfb

  • SHA512

    3cce1ccad7e4b340dcf7daa7171f2fc4cb3a0ddc6e463da19b55255bf2d87141c1b8b3e23621e230d17f44135af4e869ce310ee12072fdc13ec90ffda9c2a2ad

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Y:gh+ZkldoPK8YaKGY

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3b5fdadf8fffda01b256bbe982f54f01648fb9732c9f41f99f7d9dfe7d58ecfb.exe

    • Size

      904KB

    • MD5

      1dcc4862b7df3dc9ed3d87a97ad0c3c0

    • SHA1

      f11a4a029a103c554fd987b76f7fd0467543389b

    • SHA256

      3b5fdadf8fffda01b256bbe982f54f01648fb9732c9f41f99f7d9dfe7d58ecfb

    • SHA512

      3cce1ccad7e4b340dcf7daa7171f2fc4cb3a0ddc6e463da19b55255bf2d87141c1b8b3e23621e230d17f44135af4e869ce310ee12072fdc13ec90ffda9c2a2ad

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Y:gh+ZkldoPK8YaKGY

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks