General

  • Target

    31001e11f614524f3ab65dac5c9c2bc8268970c6b4c2b686439a293e9f1724c3.exe

  • Size

    901KB

  • Sample

    250124-br9xxaspax

  • MD5

    fbfb536d9f11340aed031fa098253a9d

  • SHA1

    53eb011dbdf53abca1ed636a25ad14c33be5b5e3

  • SHA256

    31001e11f614524f3ab65dac5c9c2bc8268970c6b4c2b686439a293e9f1724c3

  • SHA512

    495cebf1c7e6dda021811998ca0b1bc2fbeff6c6224e4eede0101c333e4e3eb687edfbb4d334cbecbf28957cf422fed3ae17c6c5770409b368b1978ace02fdfc

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5+:gh+ZkldoPK8YaKG+

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      31001e11f614524f3ab65dac5c9c2bc8268970c6b4c2b686439a293e9f1724c3.exe

    • Size

      901KB

    • MD5

      fbfb536d9f11340aed031fa098253a9d

    • SHA1

      53eb011dbdf53abca1ed636a25ad14c33be5b5e3

    • SHA256

      31001e11f614524f3ab65dac5c9c2bc8268970c6b4c2b686439a293e9f1724c3

    • SHA512

      495cebf1c7e6dda021811998ca0b1bc2fbeff6c6224e4eede0101c333e4e3eb687edfbb4d334cbecbf28957cf422fed3ae17c6c5770409b368b1978ace02fdfc

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5+:gh+ZkldoPK8YaKG+

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks