General

  • Target

    4ee0ec29adfa239c36143e772654ba2fc40cdbc15e3452e44e5148fdd96327da.exe

  • Size

    905KB

  • Sample

    250112-fn4zpsxngx

  • MD5

    dec21cdc832ba70a530e1c6c65980997

  • SHA1

    ed50dc7877e998aae65b0b12369aede2ed6993f7

  • SHA256

    4ee0ec29adfa239c36143e772654ba2fc40cdbc15e3452e44e5148fdd96327da

  • SHA512

    5726c2b4a2e51c42c95960e5293d4d9f7df9c6c0844026113ff0d488f1847a49b1416dabfe8fe00baedfcf30ae81c073ca67fdfc64f921d6866db995c56b931d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4ee0ec29adfa239c36143e772654ba2fc40cdbc15e3452e44e5148fdd96327da.exe

    • Size

      905KB

    • MD5

      dec21cdc832ba70a530e1c6c65980997

    • SHA1

      ed50dc7877e998aae65b0b12369aede2ed6993f7

    • SHA256

      4ee0ec29adfa239c36143e772654ba2fc40cdbc15e3452e44e5148fdd96327da

    • SHA512

      5726c2b4a2e51c42c95960e5293d4d9f7df9c6c0844026113ff0d488f1847a49b1416dabfe8fe00baedfcf30ae81c073ca67fdfc64f921d6866db995c56b931d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks