General

  • Target

    794b4907fa2ee0bf216c9a66a6ee0cdce52d80b579a8126f739f9c9fa19c88f9

  • Size

    904KB

  • Sample

    240908-3jg1pstcja

  • MD5

    8e072d2e239824f138e0aadf3c363378

  • SHA1

    7334e0b5aefe4dc9be033e628981e56abc8cecb1

  • SHA256

    794b4907fa2ee0bf216c9a66a6ee0cdce52d80b579a8126f739f9c9fa19c88f9

  • SHA512

    b53eef6e9ae844e862cc38ce851fa695c341bc319fccebaad8c9635c5e98404e38187d3d445d42a69b2c34b0f4cfd4f1faf576cdf80d88b4d534cd7d0caf97dd

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      794b4907fa2ee0bf216c9a66a6ee0cdce52d80b579a8126f739f9c9fa19c88f9

    • Size

      904KB

    • MD5

      8e072d2e239824f138e0aadf3c363378

    • SHA1

      7334e0b5aefe4dc9be033e628981e56abc8cecb1

    • SHA256

      794b4907fa2ee0bf216c9a66a6ee0cdce52d80b579a8126f739f9c9fa19c88f9

    • SHA512

      b53eef6e9ae844e862cc38ce851fa695c341bc319fccebaad8c9635c5e98404e38187d3d445d42a69b2c34b0f4cfd4f1faf576cdf80d88b4d534cd7d0caf97dd

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks