General

  • Target

    415b101043c900c184277a02fb045337f007b28f3dfaeb4b8320a65031f6bdf7.exe

  • Size

    905KB

  • Sample

    250124-afag8s1rcl

  • MD5

    cf93b602212367bec1096e17b66029f7

  • SHA1

    913e92d7385f5b72ff9084a2fcd8b29e444e584a

  • SHA256

    415b101043c900c184277a02fb045337f007b28f3dfaeb4b8320a65031f6bdf7

  • SHA512

    6d1143d6a09c88fb419c1bea295f32c71f5bc726cf2f831e3b31aab6c39aa0bb895bc0c01181c2d6b4601e1fe793fbfb3c801fb761ebf8c2a9a1c93821c76dd8

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      415b101043c900c184277a02fb045337f007b28f3dfaeb4b8320a65031f6bdf7.exe

    • Size

      905KB

    • MD5

      cf93b602212367bec1096e17b66029f7

    • SHA1

      913e92d7385f5b72ff9084a2fcd8b29e444e584a

    • SHA256

      415b101043c900c184277a02fb045337f007b28f3dfaeb4b8320a65031f6bdf7

    • SHA512

      6d1143d6a09c88fb419c1bea295f32c71f5bc726cf2f831e3b31aab6c39aa0bb895bc0c01181c2d6b4601e1fe793fbfb3c801fb761ebf8c2a9a1c93821c76dd8

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks