General

  • Target

    3419423fa7fedb33fa0d2e7705fef5b0b9c0b62c079808b659b68a7f56c456ceN.exe

  • Size

    905KB

  • Sample

    250112-qvxjbatqhx

  • MD5

    420eb789d738424d7cf60a9839d0e580

  • SHA1

    488cd57e60e2d048a58491f1d238364539af1a73

  • SHA256

    3419423fa7fedb33fa0d2e7705fef5b0b9c0b62c079808b659b68a7f56c456ce

  • SHA512

    29eeb5e1e54951f546380c2646848a94c7aa4f867283d8b66db47deac79216a0f7f9d4c0f2f65711a70365ef2e2cb212c3393264cdb80a521c05c898b85547de

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3419423fa7fedb33fa0d2e7705fef5b0b9c0b62c079808b659b68a7f56c456ceN.exe

    • Size

      905KB

    • MD5

      420eb789d738424d7cf60a9839d0e580

    • SHA1

      488cd57e60e2d048a58491f1d238364539af1a73

    • SHA256

      3419423fa7fedb33fa0d2e7705fef5b0b9c0b62c079808b659b68a7f56c456ce

    • SHA512

      29eeb5e1e54951f546380c2646848a94c7aa4f867283d8b66db47deac79216a0f7f9d4c0f2f65711a70365ef2e2cb212c3393264cdb80a521c05c898b85547de

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks