General

  • Target

    3c22a18786d5aeea7b901df70e726b7e11facaef0b774d30df2702e1f23394c7.exe

  • Size

    905KB

  • Sample

    250112-r757nazjap

  • MD5

    2b08175d18dc1db7d35782a180b77510

  • SHA1

    c7365bd8c5b44ba7684613de558aac84b7f6b429

  • SHA256

    3c22a18786d5aeea7b901df70e726b7e11facaef0b774d30df2702e1f23394c7

  • SHA512

    489c0a5f919aad0488bf4b7e45bf945714e572bb24ab88c95301565fff0c550172cfeca729832202af8b2c09b6bd96b043ea00d3791a72b165c216354f9f02a7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3c22a18786d5aeea7b901df70e726b7e11facaef0b774d30df2702e1f23394c7.exe

    • Size

      905KB

    • MD5

      2b08175d18dc1db7d35782a180b77510

    • SHA1

      c7365bd8c5b44ba7684613de558aac84b7f6b429

    • SHA256

      3c22a18786d5aeea7b901df70e726b7e11facaef0b774d30df2702e1f23394c7

    • SHA512

      489c0a5f919aad0488bf4b7e45bf945714e572bb24ab88c95301565fff0c550172cfeca729832202af8b2c09b6bd96b043ea00d3791a72b165c216354f9f02a7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks