General

  • Target

    5fdae1cf9a52ba4607107dbb8f3d0618935087bdda924437e8bb43a3f905e0ee.exe

  • Size

    904KB

  • Sample

    250102-acgr5ssjc1

  • MD5

    6d92f3484a55c6d3dd443d8661e1e1b6

  • SHA1

    ec41e9f4a0dd2193d5bcd19f271a10dc14e619c9

  • SHA256

    5fdae1cf9a52ba4607107dbb8f3d0618935087bdda924437e8bb43a3f905e0ee

  • SHA512

    34f600f6978c03eeece38f502a878ee50b1d35584724b7b943cefdd4e0ee8f38e213ff322a401ed531a07901f028df69006efb0282ac1d5e3cdf8fa1514fcba5

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5t:gh+ZkldoPK8YaKGt

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      5fdae1cf9a52ba4607107dbb8f3d0618935087bdda924437e8bb43a3f905e0ee.exe

    • Size

      904KB

    • MD5

      6d92f3484a55c6d3dd443d8661e1e1b6

    • SHA1

      ec41e9f4a0dd2193d5bcd19f271a10dc14e619c9

    • SHA256

      5fdae1cf9a52ba4607107dbb8f3d0618935087bdda924437e8bb43a3f905e0ee

    • SHA512

      34f600f6978c03eeece38f502a878ee50b1d35584724b7b943cefdd4e0ee8f38e213ff322a401ed531a07901f028df69006efb0282ac1d5e3cdf8fa1514fcba5

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5t:gh+ZkldoPK8YaKGt

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks