General

  • Target

    e50e63ad92c87ee717577c1f4677e131b56df376910f02211bd5f2f50cb45cdf.exe

  • Size

    905KB

  • Sample

    250110-l1m5ls1lg1

  • MD5

    31783ad1e702ecf7bf8f48b8298836c4

  • SHA1

    16a492775ec5ce23f95142a59dbefc04bc8a1cbf

  • SHA256

    e50e63ad92c87ee717577c1f4677e131b56df376910f02211bd5f2f50cb45cdf

  • SHA512

    ff2fba2008bb53f5c3896032b17a27f19ffc9b9c16e1536e45feef727813d18ae991a2c17ce3f6fddc280e837a01a2956c6ac5eb367381702e3d659b741f799f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e50e63ad92c87ee717577c1f4677e131b56df376910f02211bd5f2f50cb45cdf.exe

    • Size

      905KB

    • MD5

      31783ad1e702ecf7bf8f48b8298836c4

    • SHA1

      16a492775ec5ce23f95142a59dbefc04bc8a1cbf

    • SHA256

      e50e63ad92c87ee717577c1f4677e131b56df376910f02211bd5f2f50cb45cdf

    • SHA512

      ff2fba2008bb53f5c3896032b17a27f19ffc9b9c16e1536e45feef727813d18ae991a2c17ce3f6fddc280e837a01a2956c6ac5eb367381702e3d659b741f799f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks