General

  • Target

    8904febb8cd25fa52287bc15474f3750N

  • Size

    904KB

  • Sample

    240914-bncg8szajk

  • MD5

    8904febb8cd25fa52287bc15474f3750

  • SHA1

    1aec52def86f7ac008f16678203e945a2c411715

  • SHA256

    ed21455ea01a9a6e9b71ec5f6e77fe3c3c8a2076c1354303306f43439f0b6820

  • SHA512

    fe409cc7d6dd5d71f57daa9aae1be1a4c80bd79eacb9b2e896a431e53c1133826e32e0e9d08c4d36c59bd85df4329144e4ed036e51bf45e7d287f85a6fcc89d7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8904febb8cd25fa52287bc15474f3750N

    • Size

      904KB

    • MD5

      8904febb8cd25fa52287bc15474f3750

    • SHA1

      1aec52def86f7ac008f16678203e945a2c411715

    • SHA256

      ed21455ea01a9a6e9b71ec5f6e77fe3c3c8a2076c1354303306f43439f0b6820

    • SHA512

      fe409cc7d6dd5d71f57daa9aae1be1a4c80bd79eacb9b2e896a431e53c1133826e32e0e9d08c4d36c59bd85df4329144e4ed036e51bf45e7d287f85a6fcc89d7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks