General

  • Target

    601ebc1c647c18f6d85dfd37743e0cc0N

  • Size

    904KB

  • Sample

    240910-3g11sssarg

  • MD5

    601ebc1c647c18f6d85dfd37743e0cc0

  • SHA1

    0410da3efa180bba92135565d1f5d3986209ffc9

  • SHA256

    28d49549d1eae2f046aeddccc801dfae127fdc21e2a660f512c94f35f154d1b4

  • SHA512

    6a6884034ad05d143e9e01c3c7c81f8f46ef92322288d93b76eb009140ab847b768326cf61a381ac29e34384596cef2ef1ba05f00108a12a5235c6974cf99ec0

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5z:gh+ZkldoPK8YaKGz

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      601ebc1c647c18f6d85dfd37743e0cc0N

    • Size

      904KB

    • MD5

      601ebc1c647c18f6d85dfd37743e0cc0

    • SHA1

      0410da3efa180bba92135565d1f5d3986209ffc9

    • SHA256

      28d49549d1eae2f046aeddccc801dfae127fdc21e2a660f512c94f35f154d1b4

    • SHA512

      6a6884034ad05d143e9e01c3c7c81f8f46ef92322288d93b76eb009140ab847b768326cf61a381ac29e34384596cef2ef1ba05f00108a12a5235c6974cf99ec0

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5z:gh+ZkldoPK8YaKGz

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks