General

  • Target

    6590b98d62bf7ba4cf9a3342ef4443f071e58545e52ee07a514122c4bc20b411N.exe

  • Size

    904KB

  • Sample

    241208-dg2jwsypfx

  • MD5

    e1a8a8af1d3f3363fcc51a6a36e08550

  • SHA1

    b831fa07fd70d34b9f799785898f3a97a8714fe2

  • SHA256

    6590b98d62bf7ba4cf9a3342ef4443f071e58545e52ee07a514122c4bc20b411

  • SHA512

    32518ef85c84d82efd19fa0349562c9b2e107beb868a1efc88a6e8a796081979e4586143b156a91b27e895cf43e0cc1a0b16ce86db66e6e87afe10588801f93a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Q:gh+ZkldoPK8YaKGQ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6590b98d62bf7ba4cf9a3342ef4443f071e58545e52ee07a514122c4bc20b411N.exe

    • Size

      904KB

    • MD5

      e1a8a8af1d3f3363fcc51a6a36e08550

    • SHA1

      b831fa07fd70d34b9f799785898f3a97a8714fe2

    • SHA256

      6590b98d62bf7ba4cf9a3342ef4443f071e58545e52ee07a514122c4bc20b411

    • SHA512

      32518ef85c84d82efd19fa0349562c9b2e107beb868a1efc88a6e8a796081979e4586143b156a91b27e895cf43e0cc1a0b16ce86db66e6e87afe10588801f93a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Q:gh+ZkldoPK8YaKGQ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks