General

  • Target

    a553e76b2b966ca4013df79bd69f8dbf70f105814c4d4be8dba468ed43674ee3N.exe

  • Size

    905KB

  • Sample

    250112-zd27xayjfs

  • MD5

    9c7045e9c6deff448c0ae4d42c7921d0

  • SHA1

    0a6088bf825b045670983b69eb532ed143f3e9a4

  • SHA256

    a553e76b2b966ca4013df79bd69f8dbf70f105814c4d4be8dba468ed43674ee3

  • SHA512

    d62ca745fd0dfd707e215d991160a6691a2b8cb0f97b60b523987590f03e305bd1a5f0b9ad57dc0bef54d6157093b34daac2ee7329845d3ac6049b1873a19f4f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a553e76b2b966ca4013df79bd69f8dbf70f105814c4d4be8dba468ed43674ee3N.exe

    • Size

      905KB

    • MD5

      9c7045e9c6deff448c0ae4d42c7921d0

    • SHA1

      0a6088bf825b045670983b69eb532ed143f3e9a4

    • SHA256

      a553e76b2b966ca4013df79bd69f8dbf70f105814c4d4be8dba468ed43674ee3

    • SHA512

      d62ca745fd0dfd707e215d991160a6691a2b8cb0f97b60b523987590f03e305bd1a5f0b9ad57dc0bef54d6157093b34daac2ee7329845d3ac6049b1873a19f4f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks