General

  • Target

    ce8d17fc9947d921d463aad7f1b80906068cd5b87f081e8970c89450a60fe0e1N.exe

  • Size

    905KB

  • Sample

    250112-gp8vqa1rbk

  • MD5

    5281b7852ee05f86ac9f33cf7e312660

  • SHA1

    870cc91498553480d9c50ea4f5f5cbeb851610f1

  • SHA256

    ce8d17fc9947d921d463aad7f1b80906068cd5b87f081e8970c89450a60fe0e1

  • SHA512

    51b72a93554b5ffd2830fa95b9c0c3751c80719c5681cc431bf1c5907a1dd2a0049a57fc9a449404d02c3fe54db60e695c8821a3b8e83cfce9597149d8c23051

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      ce8d17fc9947d921d463aad7f1b80906068cd5b87f081e8970c89450a60fe0e1N.exe

    • Size

      905KB

    • MD5

      5281b7852ee05f86ac9f33cf7e312660

    • SHA1

      870cc91498553480d9c50ea4f5f5cbeb851610f1

    • SHA256

      ce8d17fc9947d921d463aad7f1b80906068cd5b87f081e8970c89450a60fe0e1

    • SHA512

      51b72a93554b5ffd2830fa95b9c0c3751c80719c5681cc431bf1c5907a1dd2a0049a57fc9a449404d02c3fe54db60e695c8821a3b8e83cfce9597149d8c23051

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks