General

  • Target

    999f2b5a00bd1a4233b56ef446a4c210N

  • Size

    904KB

  • Sample

    240911-ytk3ws1aqf

  • MD5

    999f2b5a00bd1a4233b56ef446a4c210

  • SHA1

    c258417402ac64235c965ad58898b12b8ef74974

  • SHA256

    6e8e9d2398a2e0172f2d0846e2956e7ca00ea9e2e09620b231b61d6085d4bff9

  • SHA512

    b7ee36281e38096f5b82e5bdf3743b4a507190032145304592c05cc45dbffe549a96d131154b264e8c46407db6a864cff0c7194b66292f0f0bde03fe2b4b5a80

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      999f2b5a00bd1a4233b56ef446a4c210N

    • Size

      904KB

    • MD5

      999f2b5a00bd1a4233b56ef446a4c210

    • SHA1

      c258417402ac64235c965ad58898b12b8ef74974

    • SHA256

      6e8e9d2398a2e0172f2d0846e2956e7ca00ea9e2e09620b231b61d6085d4bff9

    • SHA512

      b7ee36281e38096f5b82e5bdf3743b4a507190032145304592c05cc45dbffe549a96d131154b264e8c46407db6a864cff0c7194b66292f0f0bde03fe2b4b5a80

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks