General

  • Target

    bc000d42e571e83aa90fb991f90974ea14ede5a34ace0ab3065aaf5c605c2efd.exe

  • Size

    901KB

  • Sample

    250124-sz1smswrek

  • MD5

    2929a00b0d1fa014639efb3ba30ce347

  • SHA1

    bfc4dcb18ba6009615d6edbef92f65c78db886cd

  • SHA256

    bc000d42e571e83aa90fb991f90974ea14ede5a34ace0ab3065aaf5c605c2efd

  • SHA512

    a17c9fa7c6152c1216bc56c6e62380265e4e8a38590ab10fb7b4133b321fd218575602b907683e580d82d3466efd52bc832192a9a04eebe46dc51811eb7453c4

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bc000d42e571e83aa90fb991f90974ea14ede5a34ace0ab3065aaf5c605c2efd.exe

    • Size

      901KB

    • MD5

      2929a00b0d1fa014639efb3ba30ce347

    • SHA1

      bfc4dcb18ba6009615d6edbef92f65c78db886cd

    • SHA256

      bc000d42e571e83aa90fb991f90974ea14ede5a34ace0ab3065aaf5c605c2efd

    • SHA512

      a17c9fa7c6152c1216bc56c6e62380265e4e8a38590ab10fb7b4133b321fd218575602b907683e580d82d3466efd52bc832192a9a04eebe46dc51811eb7453c4

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks