General

  • Target

    bcb63ce50cf0e99273cf897639e4e62a0f3945239bd36745ee405c56a839ea8c.exe

  • Size

    905KB

  • Sample

    241218-mex85awmbp

  • MD5

    e8779cd6a0dc2ac30f45dbb5e05ed339

  • SHA1

    724eed74ca2241ea01bb4f72d63f68cc77f6ab9f

  • SHA256

    bcb63ce50cf0e99273cf897639e4e62a0f3945239bd36745ee405c56a839ea8c

  • SHA512

    a38a24961f29f41ff37c3800a3bce2d66676c101fb73dbb571d0a85f6704b5fc00358f23a522934213b46e126b73618458f90cfedf93ca4a5bda0ac3863e599e

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bcb63ce50cf0e99273cf897639e4e62a0f3945239bd36745ee405c56a839ea8c.exe

    • Size

      905KB

    • MD5

      e8779cd6a0dc2ac30f45dbb5e05ed339

    • SHA1

      724eed74ca2241ea01bb4f72d63f68cc77f6ab9f

    • SHA256

      bcb63ce50cf0e99273cf897639e4e62a0f3945239bd36745ee405c56a839ea8c

    • SHA512

      a38a24961f29f41ff37c3800a3bce2d66676c101fb73dbb571d0a85f6704b5fc00358f23a522934213b46e126b73618458f90cfedf93ca4a5bda0ac3863e599e

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks