General

  • Target

    f0e21ff2c38b045e9969912373d618f0N

  • Size

    904KB

  • Sample

    240907-2zrz6ssfqb

  • MD5

    f0e21ff2c38b045e9969912373d618f0

  • SHA1

    7f3aa9ba1792b0146e9f38d93cb99ad55fcf9b05

  • SHA256

    d756caf60912788635901e6af794fc074cef414410d1dffbe7f383036a3ec83a

  • SHA512

    827d40a6acbc8790b8155ceb6816bc92ac6e50a3f19656322b1edc655282c927b0a5f533771bc0e98a2a2a267493e021f0789c6384dfcb390f4b6ef867c722fa

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f0e21ff2c38b045e9969912373d618f0N

    • Size

      904KB

    • MD5

      f0e21ff2c38b045e9969912373d618f0

    • SHA1

      7f3aa9ba1792b0146e9f38d93cb99ad55fcf9b05

    • SHA256

      d756caf60912788635901e6af794fc074cef414410d1dffbe7f383036a3ec83a

    • SHA512

      827d40a6acbc8790b8155ceb6816bc92ac6e50a3f19656322b1edc655282c927b0a5f533771bc0e98a2a2a267493e021f0789c6384dfcb390f4b6ef867c722fa

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks