General

  • Target

    71c441b66ddc8f1a77ca2405c9f9fad104a7c2227052e0daebd18f4193808543.exe

  • Size

    901KB

  • Sample

    250123-1pcxtsvlf1

  • MD5

    ac621d66d0c6901642da821be3982aa2

  • SHA1

    7d283496e4e5f73bd3d4b36289853ef0f6cec08c

  • SHA256

    71c441b66ddc8f1a77ca2405c9f9fad104a7c2227052e0daebd18f4193808543

  • SHA512

    d13b1b19ef27d9b6cd23042f3bbb8fbb778d78377aa1dc5043e01198e96c1281862c9121b9743e38d6e3736e54337114adbd3cfc9ecc7f572c3ed4809f477b68

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5d:gh+ZkldoPK8YaKGd

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      71c441b66ddc8f1a77ca2405c9f9fad104a7c2227052e0daebd18f4193808543.exe

    • Size

      901KB

    • MD5

      ac621d66d0c6901642da821be3982aa2

    • SHA1

      7d283496e4e5f73bd3d4b36289853ef0f6cec08c

    • SHA256

      71c441b66ddc8f1a77ca2405c9f9fad104a7c2227052e0daebd18f4193808543

    • SHA512

      d13b1b19ef27d9b6cd23042f3bbb8fbb778d78377aa1dc5043e01198e96c1281862c9121b9743e38d6e3736e54337114adbd3cfc9ecc7f572c3ed4809f477b68

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5d:gh+ZkldoPK8YaKGd

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks