General

  • Target

    fff3293aedaf3e5b9583e253971b019845f69432612cf30e4f11dedaae245f77N.exe

  • Size

    904KB

  • Sample

    241208-fr2nratrby

  • MD5

    e15c011aee873ab7cd6fb2fc6d362190

  • SHA1

    16a5df690ae69b5c7bd03f48ab41b1c76098ffad

  • SHA256

    fff3293aedaf3e5b9583e253971b019845f69432612cf30e4f11dedaae245f77

  • SHA512

    18bdd96aa3a201daa189707ad4b573731215d3b8e1588984c761218fafd4cdf30e15fe8627d976c4ed3d9664f2a4ccdbff3a4001be757dfa9b965b1aa1546007

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5u:gh+ZkldoPK8YaKGu

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      fff3293aedaf3e5b9583e253971b019845f69432612cf30e4f11dedaae245f77N.exe

    • Size

      904KB

    • MD5

      e15c011aee873ab7cd6fb2fc6d362190

    • SHA1

      16a5df690ae69b5c7bd03f48ab41b1c76098ffad

    • SHA256

      fff3293aedaf3e5b9583e253971b019845f69432612cf30e4f11dedaae245f77

    • SHA512

      18bdd96aa3a201daa189707ad4b573731215d3b8e1588984c761218fafd4cdf30e15fe8627d976c4ed3d9664f2a4ccdbff3a4001be757dfa9b965b1aa1546007

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5u:gh+ZkldoPK8YaKGu

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks