General

  • Target

    a6e023488c6fd2661e2a4778be5840a2df7ad17e7efb26cb1335f8d78ed41f94

  • Size

    903KB

  • Sample

    240812-a56xqsxcrj

  • MD5

    46e80b388671ca036a6a7810833e6c06

  • SHA1

    0e628999bded77dd11934ea6f3e35564d84d51b4

  • SHA256

    a6e023488c6fd2661e2a4778be5840a2df7ad17e7efb26cb1335f8d78ed41f94

  • SHA512

    58b1bbae678a52370c8e10448ec4bfd1ce3156368d80b05e506564050bdb92afac24be732703e796a2500fa78476d00b7cc82567806557e0a35a087019918e88

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5c:gh+ZkldoPK8YaKGc

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a6e023488c6fd2661e2a4778be5840a2df7ad17e7efb26cb1335f8d78ed41f94

    • Size

      903KB

    • MD5

      46e80b388671ca036a6a7810833e6c06

    • SHA1

      0e628999bded77dd11934ea6f3e35564d84d51b4

    • SHA256

      a6e023488c6fd2661e2a4778be5840a2df7ad17e7efb26cb1335f8d78ed41f94

    • SHA512

      58b1bbae678a52370c8e10448ec4bfd1ce3156368d80b05e506564050bdb92afac24be732703e796a2500fa78476d00b7cc82567806557e0a35a087019918e88

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5c:gh+ZkldoPK8YaKGc

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks