General

  • Target

    0e50823aeed94d025e406eb0f2827f833badbcbf66e988ef270e0512a5a09799N.exe

  • Size

    904KB

  • Sample

    241206-mbpgtasmew

  • MD5

    1de03f40d11d0cc76c01a42ba87ab790

  • SHA1

    8e6c734f812bb0ff515acffecf630e8a59c1e2bd

  • SHA256

    0e50823aeed94d025e406eb0f2827f833badbcbf66e988ef270e0512a5a09799

  • SHA512

    31bffbb002876e06bb58d7701dd564aca0ddff25660f5d4665075e3cc84ecca77d7bc40f0e3d7701a94807c5e041125dc907879642c9bd4f960b7b4771d87ce7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa56:gh+ZkldoPK8YaKG6

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      0e50823aeed94d025e406eb0f2827f833badbcbf66e988ef270e0512a5a09799N.exe

    • Size

      904KB

    • MD5

      1de03f40d11d0cc76c01a42ba87ab790

    • SHA1

      8e6c734f812bb0ff515acffecf630e8a59c1e2bd

    • SHA256

      0e50823aeed94d025e406eb0f2827f833badbcbf66e988ef270e0512a5a09799

    • SHA512

      31bffbb002876e06bb58d7701dd564aca0ddff25660f5d4665075e3cc84ecca77d7bc40f0e3d7701a94807c5e041125dc907879642c9bd4f960b7b4771d87ce7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa56:gh+ZkldoPK8YaKG6

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks