General

  • Target

    fe5cf1bcd8ba32f59e00a66fd1432615cc7a1599cc372cbb9c90052b3a288c06

  • Size

    904KB

  • Sample

    240812-fawq6swbpk

  • MD5

    c073f433f33b2635bd522162337f697c

  • SHA1

    8346bc300e0491d3df19076b7ffeacbb5fa9f606

  • SHA256

    fe5cf1bcd8ba32f59e00a66fd1432615cc7a1599cc372cbb9c90052b3a288c06

  • SHA512

    329f3c404e5b2f430c10f07f6647bae409bcb4e7e1d976036172ad9d32aad761bafd79aabd04466f13db94dc6dc10ae4a1c97dd2e38cf78e3f39d0875c97c50d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      fe5cf1bcd8ba32f59e00a66fd1432615cc7a1599cc372cbb9c90052b3a288c06

    • Size

      904KB

    • MD5

      c073f433f33b2635bd522162337f697c

    • SHA1

      8346bc300e0491d3df19076b7ffeacbb5fa9f606

    • SHA256

      fe5cf1bcd8ba32f59e00a66fd1432615cc7a1599cc372cbb9c90052b3a288c06

    • SHA512

      329f3c404e5b2f430c10f07f6647bae409bcb4e7e1d976036172ad9d32aad761bafd79aabd04466f13db94dc6dc10ae4a1c97dd2e38cf78e3f39d0875c97c50d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks