General

  • Target

    8534d488b6ab71e51064744e1efdf96310516d7a81080eb11645742abb27c983.exe

  • Size

    904KB

  • Sample

    250101-zhcstatkbx

  • MD5

    2a74637c020455e2e092543fe63a3879

  • SHA1

    89ceda0ef8474b6fdb8a3e943a2ac1c41c86177d

  • SHA256

    8534d488b6ab71e51064744e1efdf96310516d7a81080eb11645742abb27c983

  • SHA512

    be9c1102410a46b684df5ec9d4b1134a4db0b34553f19c2baf2e10d570a40eb5deedc1c8dd3925338a778e8953670bb70fb0fe9fcc415aebdbb33add1907d647

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8534d488b6ab71e51064744e1efdf96310516d7a81080eb11645742abb27c983.exe

    • Size

      904KB

    • MD5

      2a74637c020455e2e092543fe63a3879

    • SHA1

      89ceda0ef8474b6fdb8a3e943a2ac1c41c86177d

    • SHA256

      8534d488b6ab71e51064744e1efdf96310516d7a81080eb11645742abb27c983

    • SHA512

      be9c1102410a46b684df5ec9d4b1134a4db0b34553f19c2baf2e10d570a40eb5deedc1c8dd3925338a778e8953670bb70fb0fe9fcc415aebdbb33add1907d647

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks