General

  • Target

    bd8d4f7159468f7748bd7104fe0e3379a98aa1a5a1eb24c60d05ac3ffaaec6f8.exe

  • Size

    905KB

  • Sample

    241231-n68pls1qhl

  • MD5

    ba135f187abd61a8f5b31b137d6d0361

  • SHA1

    7b7f7ead69003c7f8c4c02216e178dbaadc110a0

  • SHA256

    bd8d4f7159468f7748bd7104fe0e3379a98aa1a5a1eb24c60d05ac3ffaaec6f8

  • SHA512

    5f0b7cc8ae99127eadb7fdf8c044db7bcec2ed5558e0e801fc57596af62ffeb085e0a37a90e0a0c8b9607814aa7bb75f2a0c790be59390c1e628d0f5af5a6cdb

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5o:gh+ZkldoPK8YaKGo

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bd8d4f7159468f7748bd7104fe0e3379a98aa1a5a1eb24c60d05ac3ffaaec6f8.exe

    • Size

      905KB

    • MD5

      ba135f187abd61a8f5b31b137d6d0361

    • SHA1

      7b7f7ead69003c7f8c4c02216e178dbaadc110a0

    • SHA256

      bd8d4f7159468f7748bd7104fe0e3379a98aa1a5a1eb24c60d05ac3ffaaec6f8

    • SHA512

      5f0b7cc8ae99127eadb7fdf8c044db7bcec2ed5558e0e801fc57596af62ffeb085e0a37a90e0a0c8b9607814aa7bb75f2a0c790be59390c1e628d0f5af5a6cdb

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5o:gh+ZkldoPK8YaKGo

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks