Overview

overview

10

Static

static

5

d950a304ae...46.exe

windows7-x64

10

d950a304ae...46.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d950a304aebb2d93138c52d1646b01e8303f5aa9aa286fa76f41430718e12446

  • Size

    903KB

  • Sample

    240612-fldpqs1fkn

  • MD5

    60a7e875660e7501e1e991dde988e074

  • SHA1

    2f7e18eb3b283c5ec1e37dc1c40cbdea59b7c79f

  • SHA256

    d950a304aebb2d93138c52d1646b01e8303f5aa9aa286fa76f41430718e12446

  • SHA512

    11607fea4f73994cfc31cabf19e1e24f31b6264c57e78316d554ad90d8554356939bdaad23741be23df378d0779efef97c72e25d66e826dc2b28e20866a103bc

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5L:gh+ZkldoPK8YaKGL

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d950a304aebb2d93138c52d1646b01e8303f5aa9aa286fa76f41430718e12446

    • Size

      903KB

    • MD5

      60a7e875660e7501e1e991dde988e074

    • SHA1

      2f7e18eb3b283c5ec1e37dc1c40cbdea59b7c79f

    • SHA256

      d950a304aebb2d93138c52d1646b01e8303f5aa9aa286fa76f41430718e12446

    • SHA512

      11607fea4f73994cfc31cabf19e1e24f31b6264c57e78316d554ad90d8554356939bdaad23741be23df378d0779efef97c72e25d66e826dc2b28e20866a103bc

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5L:gh+ZkldoPK8YaKGL

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks