General

  • Target

    5d48cb8db79872b124578e1bdc42fab8b893e25d3c8ec145e02a55e6329bffac

  • Size

    904KB

  • Sample

    240901-2m9z8atflm

  • MD5

    380e87a21cc8c7b1a3310e866d673646

  • SHA1

    17145461e1325cc1d7189501e43e8e21b509582e

  • SHA256

    5d48cb8db79872b124578e1bdc42fab8b893e25d3c8ec145e02a55e6329bffac

  • SHA512

    61f889b28a799a9a7889e3e035230aa929cd41e47e0f8051b3edd4d227d015e70d083d7fab489afee2e04c527a0f8681a46d6c101a46b065b68c042c95b46048

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      5d48cb8db79872b124578e1bdc42fab8b893e25d3c8ec145e02a55e6329bffac

    • Size

      904KB

    • MD5

      380e87a21cc8c7b1a3310e866d673646

    • SHA1

      17145461e1325cc1d7189501e43e8e21b509582e

    • SHA256

      5d48cb8db79872b124578e1bdc42fab8b893e25d3c8ec145e02a55e6329bffac

    • SHA512

      61f889b28a799a9a7889e3e035230aa929cd41e47e0f8051b3edd4d227d015e70d083d7fab489afee2e04c527a0f8681a46d6c101a46b065b68c042c95b46048

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks