General

  • Target

    8085038f48a98acaa0fd5c44300fb4c0N

  • Size

    904KB

  • Sample

    240913-1s1s3a1cmk

  • MD5

    8085038f48a98acaa0fd5c44300fb4c0

  • SHA1

    06a4e1369f1b529bcec1c9137e1bf5b81f24c47a

  • SHA256

    9560f859fa6ed10537272b4a5848ba83572e7975645deb7d559896e9fedcc2bf

  • SHA512

    66c6f562639c8c1147e6bffbdaa59a48f42c0f3c729b9948dc76d6fa12fd2754f0e1c8df8e599cdaac7209f3eafd6eb4f5e2ccaf225abd2b4882e572feebc13b

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8085038f48a98acaa0fd5c44300fb4c0N

    • Size

      904KB

    • MD5

      8085038f48a98acaa0fd5c44300fb4c0

    • SHA1

      06a4e1369f1b529bcec1c9137e1bf5b81f24c47a

    • SHA256

      9560f859fa6ed10537272b4a5848ba83572e7975645deb7d559896e9fedcc2bf

    • SHA512

      66c6f562639c8c1147e6bffbdaa59a48f42c0f3c729b9948dc76d6fa12fd2754f0e1c8df8e599cdaac7209f3eafd6eb4f5e2ccaf225abd2b4882e572feebc13b

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks