General

  • Target

    e91312e3bf850be8b2e0b281d4e40cd95d0e7f5260efe1a3e78e477d744cb991N.exe

  • Size

    904KB

  • Sample

    241216-plq5ha1meq

  • MD5

    70742a695db87c530119b4eb0b2fa4a0

  • SHA1

    474e0d90298584396fa8a275746759e7ce67e542

  • SHA256

    e91312e3bf850be8b2e0b281d4e40cd95d0e7f5260efe1a3e78e477d744cb991

  • SHA512

    94368fa7333f9e609358530077d680fa08c3d5ebf5699ccc0646e34753af0df00f3a35009e1ff2265f939bdd9f728abba3f93d397e70e4870c4536a0bd4f9954

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e91312e3bf850be8b2e0b281d4e40cd95d0e7f5260efe1a3e78e477d744cb991N.exe

    • Size

      904KB

    • MD5

      70742a695db87c530119b4eb0b2fa4a0

    • SHA1

      474e0d90298584396fa8a275746759e7ce67e542

    • SHA256

      e91312e3bf850be8b2e0b281d4e40cd95d0e7f5260efe1a3e78e477d744cb991

    • SHA512

      94368fa7333f9e609358530077d680fa08c3d5ebf5699ccc0646e34753af0df00f3a35009e1ff2265f939bdd9f728abba3f93d397e70e4870c4536a0bd4f9954

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks