General

  • Target

    22db35581f37a1bb759443a2f377126ef113bb6f0cdde79902e672fba8dc8d1f.exe

  • Size

    904KB

  • Sample

    241211-npme2svqam

  • MD5

    4b0244716397946fa51c3ecc448439ee

  • SHA1

    7b84e186fc03863012535dac2ac2018cd9a09f95

  • SHA256

    22db35581f37a1bb759443a2f377126ef113bb6f0cdde79902e672fba8dc8d1f

  • SHA512

    1e48b573300e63bfba0aa2ea549d731a94b77b2861048bfcce8a7ab28d64719cf6cdbc867e2b41e8e886a98bc4cbb7ab27cff436aa03adc3ccb3c7ae3e2eae92

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      22db35581f37a1bb759443a2f377126ef113bb6f0cdde79902e672fba8dc8d1f.exe

    • Size

      904KB

    • MD5

      4b0244716397946fa51c3ecc448439ee

    • SHA1

      7b84e186fc03863012535dac2ac2018cd9a09f95

    • SHA256

      22db35581f37a1bb759443a2f377126ef113bb6f0cdde79902e672fba8dc8d1f

    • SHA512

      1e48b573300e63bfba0aa2ea549d731a94b77b2861048bfcce8a7ab28d64719cf6cdbc867e2b41e8e886a98bc4cbb7ab27cff436aa03adc3ccb3c7ae3e2eae92

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks