General

  • Target

    3f8e07a8bc387a9a5f63e0e997004e146487a63dd75c35eb0425ebff9349e011N.exe

  • Size

    901KB

  • Sample

    250124-bba4ms1qd1

  • MD5

    1d88ff7eb547407192cb4fc30180c3d0

  • SHA1

    1fe1ef2528f1a0fb283505442052d17661c1172c

  • SHA256

    3f8e07a8bc387a9a5f63e0e997004e146487a63dd75c35eb0425ebff9349e011

  • SHA512

    14bf6126c7adc09c4c863776a2c30af3745522e1a5ed69d22475572f32c368ab8c0b2554b1ef99ea9719ade8637fd79b319051ab976ac4a57c788672e0fe9116

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa51:gh+ZkldoPK8YaKG1

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3f8e07a8bc387a9a5f63e0e997004e146487a63dd75c35eb0425ebff9349e011N.exe

    • Size

      901KB

    • MD5

      1d88ff7eb547407192cb4fc30180c3d0

    • SHA1

      1fe1ef2528f1a0fb283505442052d17661c1172c

    • SHA256

      3f8e07a8bc387a9a5f63e0e997004e146487a63dd75c35eb0425ebff9349e011

    • SHA512

      14bf6126c7adc09c4c863776a2c30af3745522e1a5ed69d22475572f32c368ab8c0b2554b1ef99ea9719ade8637fd79b319051ab976ac4a57c788672e0fe9116

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa51:gh+ZkldoPK8YaKG1

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks