General

  • Target

    f005660e2a0a4f07b80d67a10a556ef5bb11f17145d990451434d827cd345aa5N.exe

  • Size

    904KB

  • Sample

    250104-kt8x3avjdp

  • MD5

    5ee423cf7ae7a9e4a4f2a1b69eadc360

  • SHA1

    6472fa8f463f71ad2922005f4e327332d9ddbad7

  • SHA256

    f005660e2a0a4f07b80d67a10a556ef5bb11f17145d990451434d827cd345aa5

  • SHA512

    12a1e47de72dede99c71e2238c1e5c132376056d50c3b4b8923ad9bca89fa73730028feedd46a926df30b6a69acbf79c100797279367f00683467b06cf4c6085

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f005660e2a0a4f07b80d67a10a556ef5bb11f17145d990451434d827cd345aa5N.exe

    • Size

      904KB

    • MD5

      5ee423cf7ae7a9e4a4f2a1b69eadc360

    • SHA1

      6472fa8f463f71ad2922005f4e327332d9ddbad7

    • SHA256

      f005660e2a0a4f07b80d67a10a556ef5bb11f17145d990451434d827cd345aa5

    • SHA512

      12a1e47de72dede99c71e2238c1e5c132376056d50c3b4b8923ad9bca89fa73730028feedd46a926df30b6a69acbf79c100797279367f00683467b06cf4c6085

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks