General
- Target 2026-03-13_3d3977ca15a766d33e35114dae53300a_agent-tesla_amadey_darkgate_elex_hawkeye_icedid_maze_njrat_remcos
- Size 1023KB
- Sample260313-2j8b8acv4w
- SHA256 b60b977a8da0dc21298a08dd2e2caba18196d08e2bea594654b17b399af79646
- MD5 3d3977ca15a766d33e35114dae53300a
- SHA1 ac4e05673c0c3543884c84d540da0f8b3c64f6cc
- SHA512 9e819d731c2516aa043abc3c37695dd924e09612195b3f8f10bc3477a7b40911b64bcf20a5972ae188a7f21414f2d320891db4ad4a98693ef0bb912886c4c0ee
- SSDEEP 24576:xAHnh+eWsN3skA4RV1Hom2KXMmHaKZT5po:Ih+ZkldoPK8YaKjy
- TLSH T1A5259C0673D1C0B2FFAB96739F25B24156BD78660523862F12D81A7DBC701B15B3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-03-13_3d3977ca15a766d33e35114dae53300a_agent-tesla_amadey_darkgate_elex_hawkeye_icedid_maze_njrat_remcos.exe
Resource
win10v2004-20260130-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-03-13_3d3977ca15a766d33e35114dae53300a_agent-tesla_amadey_darkgate_elex_hawkeye_icedid_maze_njrat_remcos.exe
Resource
win11-20260130-en
9 signatures
150 seconds
Malware Config
Extracted
Family
-
revengerat
Botnet
-
Marzo26
C2
-
marzorevenger.duckdns.org:4230
Mutex
-
RV_MUTEX-PiGGjjtnxDpn
Targets
-
- Target 2026-03-13_3d3977ca15a766d33e35114dae53300a_agent-tesla_amadey_darkgate_elex_hawkeye_icedid_maze_njrat_remcos
- Size 1023KB
- SHA256 b60b977a8da0dc21298a08dd2e2caba18196d08e2bea594654b17b399af79646
- MD5 3d3977ca15a766d33e35114dae53300a
- SHA1 ac4e05673c0c3543884c84d540da0f8b3c64f6cc
- SHA512 9e819d731c2516aa043abc3c37695dd924e09612195b3f8f10bc3477a7b40911b64bcf20a5972ae188a7f21414f2d320891db4ad4a98693ef0bb912886c4c0ee
- SSDEEP 24576:xAHnh+eWsN3skA4RV1Hom2KXMmHaKZT5po:Ih+ZkldoPK8YaKjy
- TLSH T1A5259C0673D1C0B2FFAB96739F25B24156BD78660523862F12D81A7DBC701B15B3EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score10/10-
Revengerat family
-
Drops startup file
-
Suspicious use of SetThreadContext