General

  • Target

    dca869b1d6dd577841e6b1cfcc489a4e2b8d2563578a6fecb8c7e1c27433fd84

  • Size

    903KB

  • Sample

    240811-dn3qjasdlm

  • MD5

    119d910385689269f175e28db49ec91b

  • SHA1

    c31ce6a7d53d7bcdec46c90614a384b842918499

  • SHA256

    dca869b1d6dd577841e6b1cfcc489a4e2b8d2563578a6fecb8c7e1c27433fd84

  • SHA512

    9335ac6b7979dae176851fd27bc6e61f9e60b460bfb9f5629e8926217cee2f7958e347dc5cd8cdcdef4b7f32e1d29493f71cf2c88c6a334ce470cf08a31ae256

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      dca869b1d6dd577841e6b1cfcc489a4e2b8d2563578a6fecb8c7e1c27433fd84

    • Size

      903KB

    • MD5

      119d910385689269f175e28db49ec91b

    • SHA1

      c31ce6a7d53d7bcdec46c90614a384b842918499

    • SHA256

      dca869b1d6dd577841e6b1cfcc489a4e2b8d2563578a6fecb8c7e1c27433fd84

    • SHA512

      9335ac6b7979dae176851fd27bc6e61f9e60b460bfb9f5629e8926217cee2f7958e347dc5cd8cdcdef4b7f32e1d29493f71cf2c88c6a334ce470cf08a31ae256

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks