General

  • Target

    d9bd8d729cabe5eb48a60bc104d6745ad08a7f1240a3216bdebf5dfa7e224465.exe

  • Size

    901KB

  • Sample

    250123-3vb9layrby

  • MD5

    c4832b25f92cb5a9abe08c3ee9ae1f2c

  • SHA1

    37f5580879197c96a5e36583314dca7758ba8273

  • SHA256

    d9bd8d729cabe5eb48a60bc104d6745ad08a7f1240a3216bdebf5dfa7e224465

  • SHA512

    d76f8008ba4769a39d97d9ef40d97a83b92722b3f5ca552510e6061eaea2d0bad951591eb118bc43925866232b53a1dcefae135893e802f75b9439015bc004c5

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Z:gh+ZkldoPK8YaKGZ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d9bd8d729cabe5eb48a60bc104d6745ad08a7f1240a3216bdebf5dfa7e224465.exe

    • Size

      901KB

    • MD5

      c4832b25f92cb5a9abe08c3ee9ae1f2c

    • SHA1

      37f5580879197c96a5e36583314dca7758ba8273

    • SHA256

      d9bd8d729cabe5eb48a60bc104d6745ad08a7f1240a3216bdebf5dfa7e224465

    • SHA512

      d76f8008ba4769a39d97d9ef40d97a83b92722b3f5ca552510e6061eaea2d0bad951591eb118bc43925866232b53a1dcefae135893e802f75b9439015bc004c5

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Z:gh+ZkldoPK8YaKGZ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks