General

  • Target

    f7f9ad0cac3e5c0a1529685e47389cb0N

  • Size

    904KB

  • Sample

    240913-hy7vfszhrm

  • MD5

    f7f9ad0cac3e5c0a1529685e47389cb0

  • SHA1

    0e2b1eaa3aee39d74fd5f660cd3ae84d4f830f40

  • SHA256

    1227e3eb6cf4e3c4d20ad801ecc077ff83f9a850640ef4f52349d3398b5147ee

  • SHA512

    fef958720075b3d7e1c93399d436dd3ec84137b3712e9a9c48ee1a2fe692aa6a9b593c4fb724c8f196266013393844712c330cd2aeb6f82cdb0314e98b8a6c8a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f7f9ad0cac3e5c0a1529685e47389cb0N

    • Size

      904KB

    • MD5

      f7f9ad0cac3e5c0a1529685e47389cb0

    • SHA1

      0e2b1eaa3aee39d74fd5f660cd3ae84d4f830f40

    • SHA256

      1227e3eb6cf4e3c4d20ad801ecc077ff83f9a850640ef4f52349d3398b5147ee

    • SHA512

      fef958720075b3d7e1c93399d436dd3ec84137b3712e9a9c48ee1a2fe692aa6a9b593c4fb724c8f196266013393844712c330cd2aeb6f82cdb0314e98b8a6c8a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks