General

  • Target

    e5c7cb27966e8a05cae74af0220a66c0b3c453911a33dc9aa6b47b7af661d2a8

  • Size

    904KB

  • Sample

    240911-ecv2zssamd

  • MD5

    54d62ddf07e37587c0391c852b94e202

  • SHA1

    2dddc2b77536cfd851ec470641f1fafc66550f90

  • SHA256

    e5c7cb27966e8a05cae74af0220a66c0b3c453911a33dc9aa6b47b7af661d2a8

  • SHA512

    79383bbf086fd1f059643674555fdcd4abf712eb11f59b69d3ef54d316fcb15d37d516c1768d03314577bc698eac04872d7e9caab86ffbd6237ad99970d0f94d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e5c7cb27966e8a05cae74af0220a66c0b3c453911a33dc9aa6b47b7af661d2a8

    • Size

      904KB

    • MD5

      54d62ddf07e37587c0391c852b94e202

    • SHA1

      2dddc2b77536cfd851ec470641f1fafc66550f90

    • SHA256

      e5c7cb27966e8a05cae74af0220a66c0b3c453911a33dc9aa6b47b7af661d2a8

    • SHA512

      79383bbf086fd1f059643674555fdcd4abf712eb11f59b69d3ef54d316fcb15d37d516c1768d03314577bc698eac04872d7e9caab86ffbd6237ad99970d0f94d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks