General

  • Target

    c1f4251c6fc1f8cc22d93daaff1b8ec65aa9d43c06b562ffd77b1f803935e863N.exe

  • Size

    905KB

  • Sample

    241207-y4heraxjgk

  • MD5

    0073dd7d5d41dc9c50e1935e745fcc80

  • SHA1

    4f215b8f97468599a76974234b2ec93e162d50b0

  • SHA256

    c1f4251c6fc1f8cc22d93daaff1b8ec65aa9d43c06b562ffd77b1f803935e863

  • SHA512

    76b9e8b58a37ce3dce89a057ff1361e021920c050da54bcfe1d20fbcbebe36d4b15e2c8af16ef963c7856586ea230647010d7aad0a29d8ced98249c1c5b23ed0

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c1f4251c6fc1f8cc22d93daaff1b8ec65aa9d43c06b562ffd77b1f803935e863N.exe

    • Size

      905KB

    • MD5

      0073dd7d5d41dc9c50e1935e745fcc80

    • SHA1

      4f215b8f97468599a76974234b2ec93e162d50b0

    • SHA256

      c1f4251c6fc1f8cc22d93daaff1b8ec65aa9d43c06b562ffd77b1f803935e863

    • SHA512

      76b9e8b58a37ce3dce89a057ff1361e021920c050da54bcfe1d20fbcbebe36d4b15e2c8af16ef963c7856586ea230647010d7aad0a29d8ced98249c1c5b23ed0

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks