General

  • Target

    62d1ec6d3fbadbcb5f35185022f02c5c6b49ca833ee078bdaed8cca495ea0590

  • Size

    902KB

  • Sample

    240415-1vn72she35

  • MD5

    fc682c9c5466e9c19742e131d7296890

  • SHA1

    40ce641c340c08c4f806778cfb7d9edfdb04e850

  • SHA256

    62d1ec6d3fbadbcb5f35185022f02c5c6b49ca833ee078bdaed8cca495ea0590

  • SHA512

    cbd104315b86517edaedd9e999ecc11f174d12aae1b7810a61f0ef261700d42e2307550392afa2ad955342eed7809b6ed6fb8b631c985870cdecb3c76b23eb08

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5l:gh+ZkldoPK8YaKGl

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      62d1ec6d3fbadbcb5f35185022f02c5c6b49ca833ee078bdaed8cca495ea0590

    • Size

      902KB

    • MD5

      fc682c9c5466e9c19742e131d7296890

    • SHA1

      40ce641c340c08c4f806778cfb7d9edfdb04e850

    • SHA256

      62d1ec6d3fbadbcb5f35185022f02c5c6b49ca833ee078bdaed8cca495ea0590

    • SHA512

      cbd104315b86517edaedd9e999ecc11f174d12aae1b7810a61f0ef261700d42e2307550392afa2ad955342eed7809b6ed6fb8b631c985870cdecb3c76b23eb08

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5l:gh+ZkldoPK8YaKGl

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks