General

  • Target

    4fd3b76c86abf61a9eed459e49c809cb389cd29758cffc1d39458171da0a7c81N.exe

  • Size

    901KB

  • Sample

    250124-qjav6s1qek

  • MD5

    d93d5d9fac451f67e2d502c72b7121b0

  • SHA1

    f079cb157aa0d32d9e14753e15e4b9341db77a63

  • SHA256

    4fd3b76c86abf61a9eed459e49c809cb389cd29758cffc1d39458171da0a7c81

  • SHA512

    bc0edd4950e251580985104df63173e55dc9c22ebb05d8c8f2567818ec3d40cfd3469683aaf5bd49fc8e5eda0f66902a098dd3e61c69f91441eb4a144e420685

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4fd3b76c86abf61a9eed459e49c809cb389cd29758cffc1d39458171da0a7c81N.exe

    • Size

      901KB

    • MD5

      d93d5d9fac451f67e2d502c72b7121b0

    • SHA1

      f079cb157aa0d32d9e14753e15e4b9341db77a63

    • SHA256

      4fd3b76c86abf61a9eed459e49c809cb389cd29758cffc1d39458171da0a7c81

    • SHA512

      bc0edd4950e251580985104df63173e55dc9c22ebb05d8c8f2567818ec3d40cfd3469683aaf5bd49fc8e5eda0f66902a098dd3e61c69f91441eb4a144e420685

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks