General

  • Target

    c5062a0c5f85da5850d5f8ce402282180ec35c33baae9e7f514a67e16c3e21ecN.exe

  • Size

    905KB

  • Sample

    250124-eg1g9syjhz

  • MD5

    cac1233312c01faced41e905e31d04d0

  • SHA1

    75b3466941718a848387776caa067313b29a1f45

  • SHA256

    c5062a0c5f85da5850d5f8ce402282180ec35c33baae9e7f514a67e16c3e21ec

  • SHA512

    e8c945658b2bbace4979053b025b230ea879a228ade4573fdbfe83be4c3fcb25ba7279d8b42e9c454d4ee03e0d0aeca7c110d0e35548db3ed19f9372d46f9775

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c5062a0c5f85da5850d5f8ce402282180ec35c33baae9e7f514a67e16c3e21ecN.exe

    • Size

      905KB

    • MD5

      cac1233312c01faced41e905e31d04d0

    • SHA1

      75b3466941718a848387776caa067313b29a1f45

    • SHA256

      c5062a0c5f85da5850d5f8ce402282180ec35c33baae9e7f514a67e16c3e21ec

    • SHA512

      e8c945658b2bbace4979053b025b230ea879a228ade4573fdbfe83be4c3fcb25ba7279d8b42e9c454d4ee03e0d0aeca7c110d0e35548db3ed19f9372d46f9775

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks