General

  • Target

    fd0801cf40f6817b8a6f4efe20390870N

  • Size

    903KB

  • Sample

    240908-1g9a3awgkk

  • MD5

    fd0801cf40f6817b8a6f4efe20390870

  • SHA1

    7993b09eea305ce92cbadbae0bdd469490b92a83

  • SHA256

    bdeb753dbcdaf180d52ebe47c76f488d26ccfd4e1f3fcd79e9ee47c722af83b5

  • SHA512

    36dad43e1ffdfe8d9f236728c811205bcc0363cceb076e57b09c9794a3ce2e1ef22a71361524df55bc123cea177a9f89f2dcd1dd0d6478948ffe46bea789271c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      fd0801cf40f6817b8a6f4efe20390870N

    • Size

      903KB

    • MD5

      fd0801cf40f6817b8a6f4efe20390870

    • SHA1

      7993b09eea305ce92cbadbae0bdd469490b92a83

    • SHA256

      bdeb753dbcdaf180d52ebe47c76f488d26ccfd4e1f3fcd79e9ee47c722af83b5

    • SHA512

      36dad43e1ffdfe8d9f236728c811205bcc0363cceb076e57b09c9794a3ce2e1ef22a71361524df55bc123cea177a9f89f2dcd1dd0d6478948ffe46bea789271c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks