General

  • Target

    b0b9b3b2e584fc341120b7fa5527e828ebaf56a4e927c38fa05ff16db60c2703.exe

  • Size

    904KB

  • Sample

    241207-hb6zmswnfm

  • MD5

    9c66a935ae8c8487d95036ef26ccf225

  • SHA1

    8caca5bea77009a43e97697816be62535b9408df

  • SHA256

    b0b9b3b2e584fc341120b7fa5527e828ebaf56a4e927c38fa05ff16db60c2703

  • SHA512

    62d32c6e4255d44247f1a74e1672c9e7aa1940c41eabb150f458a17bb55d73b034f3c07b7beb205adbd1995bb486e59c527c27b2149ada6a64575eb1582b0f90

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b0b9b3b2e584fc341120b7fa5527e828ebaf56a4e927c38fa05ff16db60c2703.exe

    • Size

      904KB

    • MD5

      9c66a935ae8c8487d95036ef26ccf225

    • SHA1

      8caca5bea77009a43e97697816be62535b9408df

    • SHA256

      b0b9b3b2e584fc341120b7fa5527e828ebaf56a4e927c38fa05ff16db60c2703

    • SHA512

      62d32c6e4255d44247f1a74e1672c9e7aa1940c41eabb150f458a17bb55d73b034f3c07b7beb205adbd1995bb486e59c527c27b2149ada6a64575eb1582b0f90

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks