General

  • Target

    d7310c16948757b99616304c8a42d1bdf582d7ee932ba43e5508bafddc370c39.exe

  • Size

    904KB

  • Sample

    241222-rpn6es1nfl

  • MD5

    f6492ac722ac5fce4c70e1fa1e01459a

  • SHA1

    ba8c407e5c5ffc434bad8d7420fc8f7a9a32f4d2

  • SHA256

    d7310c16948757b99616304c8a42d1bdf582d7ee932ba43e5508bafddc370c39

  • SHA512

    87c7d320e2d5cac41916ea82074875cff3b477100987bc9015f3cc79048434dfa83ed32d96aeedd04f1f62a12cac7948c921c1334e44d438be6f57e40d7dcccb

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5b:gh+ZkldoPK8YaKGb

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d7310c16948757b99616304c8a42d1bdf582d7ee932ba43e5508bafddc370c39.exe

    • Size

      904KB

    • MD5

      f6492ac722ac5fce4c70e1fa1e01459a

    • SHA1

      ba8c407e5c5ffc434bad8d7420fc8f7a9a32f4d2

    • SHA256

      d7310c16948757b99616304c8a42d1bdf582d7ee932ba43e5508bafddc370c39

    • SHA512

      87c7d320e2d5cac41916ea82074875cff3b477100987bc9015f3cc79048434dfa83ed32d96aeedd04f1f62a12cac7948c921c1334e44d438be6f57e40d7dcccb

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5b:gh+ZkldoPK8YaKGb

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks