General

  • Target

    07c51985cfc73ef9b25d084d6c827cdf7ad487fda136c4077410e0b6a21cc909N.exe

  • Size

    905KB

  • Sample

    241225-ss3zeswphx

  • MD5

    b59f200ac4a4294c5baf52b5299271e0

  • SHA1

    4356020a12f576d82b7d967610a390f686d0c415

  • SHA256

    07c51985cfc73ef9b25d084d6c827cdf7ad487fda136c4077410e0b6a21cc909

  • SHA512

    d34da0661a29d3aa6108d7914fb9017eafc63c802d95ef21e8a2b87a0d88d9ee8792ee780c1b8f85f7b76de08489e8f98cf1514b072ce660ae1a783254826000

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      07c51985cfc73ef9b25d084d6c827cdf7ad487fda136c4077410e0b6a21cc909N.exe

    • Size

      905KB

    • MD5

      b59f200ac4a4294c5baf52b5299271e0

    • SHA1

      4356020a12f576d82b7d967610a390f686d0c415

    • SHA256

      07c51985cfc73ef9b25d084d6c827cdf7ad487fda136c4077410e0b6a21cc909

    • SHA512

      d34da0661a29d3aa6108d7914fb9017eafc63c802d95ef21e8a2b87a0d88d9ee8792ee780c1b8f85f7b76de08489e8f98cf1514b072ce660ae1a783254826000

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks