General

  • Target

    3963f63e5cf6f45cd811220d1b044fc877eb5213417eae88088a363a6253bea4N.exe

  • Size

    904KB

  • Sample

    250102-k2xvrsxnaj

  • MD5

    5cd87f0c3a963d2dc9e7097130175140

  • SHA1

    263613a2ae1d18da1221219847f5716665fd67d2

  • SHA256

    3963f63e5cf6f45cd811220d1b044fc877eb5213417eae88088a363a6253bea4

  • SHA512

    756a84fe639facbc439409ad3bbe01ab3c00c4fae4de685565a5f444b2797434610a106fd1b0e832fc7cb8a824d1c30e4ed59a4594b0c57fec2a2084eacc3891

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5V:gh+ZkldoPK8YaKGV

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3963f63e5cf6f45cd811220d1b044fc877eb5213417eae88088a363a6253bea4N.exe

    • Size

      904KB

    • MD5

      5cd87f0c3a963d2dc9e7097130175140

    • SHA1

      263613a2ae1d18da1221219847f5716665fd67d2

    • SHA256

      3963f63e5cf6f45cd811220d1b044fc877eb5213417eae88088a363a6253bea4

    • SHA512

      756a84fe639facbc439409ad3bbe01ab3c00c4fae4de685565a5f444b2797434610a106fd1b0e832fc7cb8a824d1c30e4ed59a4594b0c57fec2a2084eacc3891

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5V:gh+ZkldoPK8YaKGV

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks