Overview

overview

10

Static

static

5

300bc97502...a8.exe

windows7-x64

10

300bc97502...a8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    300bc975025ae7e085d1e8bb6704bf22f812a0bc7ee5067c2848b04549b593a8

  • Size

    903KB

  • Sample

    240624-ywyrrstfkj

  • MD5

    6ecd580ea67581fb9ff7794421191f1c

  • SHA1

    26e36c043ba9ff0d35e0b8ec53e7707faabbef11

  • SHA256

    300bc975025ae7e085d1e8bb6704bf22f812a0bc7ee5067c2848b04549b593a8

  • SHA512

    1308c360e01c200e67acb8d012a542e64a632a5f749053299ce9e5b13f384d7de421511395ae4253fea2e07f0c3d413c3d50e97f6106c0570d09d7dcb413cb9f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      300bc975025ae7e085d1e8bb6704bf22f812a0bc7ee5067c2848b04549b593a8

    • Size

      903KB

    • MD5

      6ecd580ea67581fb9ff7794421191f1c

    • SHA1

      26e36c043ba9ff0d35e0b8ec53e7707faabbef11

    • SHA256

      300bc975025ae7e085d1e8bb6704bf22f812a0bc7ee5067c2848b04549b593a8

    • SHA512

      1308c360e01c200e67acb8d012a542e64a632a5f749053299ce9e5b13f384d7de421511395ae4253fea2e07f0c3d413c3d50e97f6106c0570d09d7dcb413cb9f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks