General

  • Target

    9c9f8f33f3279b8e3311a7fcd2f336ccbc2c423428a2f87e5b8a53f582e8c503.exe

  • Size

    901KB

  • Sample

    250124-btp1hsvjdj

  • MD5

    74c9b7bc54eae2cb048221a56ebd3610

  • SHA1

    d6932798997983c45ca690816b9ff9e3d58c99bb

  • SHA256

    9c9f8f33f3279b8e3311a7fcd2f336ccbc2c423428a2f87e5b8a53f582e8c503

  • SHA512

    8ca18bf1adfe5affe22b6d96a33b32a86e49857c0bd3fee489ca6bc37faf9d04f5b3be824cfb50232031cd674601dafa55dfb225b456c96bc30b1a6edfd239b2

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9c9f8f33f3279b8e3311a7fcd2f336ccbc2c423428a2f87e5b8a53f582e8c503.exe

    • Size

      901KB

    • MD5

      74c9b7bc54eae2cb048221a56ebd3610

    • SHA1

      d6932798997983c45ca690816b9ff9e3d58c99bb

    • SHA256

      9c9f8f33f3279b8e3311a7fcd2f336ccbc2c423428a2f87e5b8a53f582e8c503

    • SHA512

      8ca18bf1adfe5affe22b6d96a33b32a86e49857c0bd3fee489ca6bc37faf9d04f5b3be824cfb50232031cd674601dafa55dfb225b456c96bc30b1a6edfd239b2

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks