General

  • Target

    30f4656f0b4f926bd940dcc3e147e9db7ebe07847dbc3f44d4ca1840bee81b8bN.exe

  • Size

    901KB

  • Sample

    250124-flt2qa1kc1

  • MD5

    615751977c7ba985b3f066ea72a55a40

  • SHA1

    b7582c981281da228cac79bca91b844f7a73406f

  • SHA256

    30f4656f0b4f926bd940dcc3e147e9db7ebe07847dbc3f44d4ca1840bee81b8b

  • SHA512

    293e25456b030fccbc61c0e9f697e606bf1795abb9fbcd91a91ab18f60a98cae038bec0f2cf96b124417241576c6b0a2584718caf842e0604a725154c7ac61b0

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5e:gh+ZkldoPK8YaKGe

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      30f4656f0b4f926bd940dcc3e147e9db7ebe07847dbc3f44d4ca1840bee81b8bN.exe

    • Size

      901KB

    • MD5

      615751977c7ba985b3f066ea72a55a40

    • SHA1

      b7582c981281da228cac79bca91b844f7a73406f

    • SHA256

      30f4656f0b4f926bd940dcc3e147e9db7ebe07847dbc3f44d4ca1840bee81b8b

    • SHA512

      293e25456b030fccbc61c0e9f697e606bf1795abb9fbcd91a91ab18f60a98cae038bec0f2cf96b124417241576c6b0a2584718caf842e0604a725154c7ac61b0

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5e:gh+ZkldoPK8YaKGe

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks