General

  • Target

    a5942fe4db862561ae7cc3c3d456179f80c83103d84ca55b3558098f063773b7

  • Size

    903KB

  • Sample

    240902-cg3araydlq

  • MD5

    30ad80abb1c2286e6163a783b28b487e

  • SHA1

    938c9f3331321669312c02169c9c0f487cea0945

  • SHA256

    a5942fe4db862561ae7cc3c3d456179f80c83103d84ca55b3558098f063773b7

  • SHA512

    90e8cd95b21f37051f9ea8f801c5ad3a199f7ad86cdce4b35aeb1b24a5545883c7afeeb3861901fe4722e9d215902835b12ec0738088233bc84dc143f1bb336c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5y:gh+ZkldoPK8YaKGy

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a5942fe4db862561ae7cc3c3d456179f80c83103d84ca55b3558098f063773b7

    • Size

      903KB

    • MD5

      30ad80abb1c2286e6163a783b28b487e

    • SHA1

      938c9f3331321669312c02169c9c0f487cea0945

    • SHA256

      a5942fe4db862561ae7cc3c3d456179f80c83103d84ca55b3558098f063773b7

    • SHA512

      90e8cd95b21f37051f9ea8f801c5ad3a199f7ad86cdce4b35aeb1b24a5545883c7afeeb3861901fe4722e9d215902835b12ec0738088233bc84dc143f1bb336c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5y:gh+ZkldoPK8YaKGy

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks