General

  • Target

    e89fd4cc1126f064070d05dd9f13aac077f4e4b36444f2cfa3523031676552e8

  • Size

    903KB

  • Sample

    240909-ekrdrs1aqj

  • MD5

    7487bf7688521e8ae8992d5dd6ac5b24

  • SHA1

    0c0d62f087b1d354fad339561d6666cffe1eea5f

  • SHA256

    e89fd4cc1126f064070d05dd9f13aac077f4e4b36444f2cfa3523031676552e8

  • SHA512

    5b1856c7e2cd12c279fae3e8db9200c2360f731f0c4a83dcedf7aa16e5bccf5ce05a253f4c466eb78117707d29c1f4150423484819c4dcd0ac5af0847776054c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa56:gh+ZkldoPK8YaKG6

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e89fd4cc1126f064070d05dd9f13aac077f4e4b36444f2cfa3523031676552e8

    • Size

      903KB

    • MD5

      7487bf7688521e8ae8992d5dd6ac5b24

    • SHA1

      0c0d62f087b1d354fad339561d6666cffe1eea5f

    • SHA256

      e89fd4cc1126f064070d05dd9f13aac077f4e4b36444f2cfa3523031676552e8

    • SHA512

      5b1856c7e2cd12c279fae3e8db9200c2360f731f0c4a83dcedf7aa16e5bccf5ce05a253f4c466eb78117707d29c1f4150423484819c4dcd0ac5af0847776054c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa56:gh+ZkldoPK8YaKG6

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks