General

  • Target

    39a047da59a7fc1c27bc5f4dcef31350N

  • Size

    904KB

  • Sample

    240914-kmwn6awbrf

  • MD5

    39a047da59a7fc1c27bc5f4dcef31350

  • SHA1

    134effc387741fef74af5bd7b92ca9f8d243d2ed

  • SHA256

    5056e5fb84287fe7c5f5300fe9eb8394c33219cfc896946e298621cb5d9de942

  • SHA512

    d385a161a0f3bbc6574a39c5d3e2f6f207c20e4997fca976e52c3b9e5164ec89f710c6d3cda9062b7dc24226c661ac4d5c29808ec2c43d328a653b6da59e833a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      39a047da59a7fc1c27bc5f4dcef31350N

    • Size

      904KB

    • MD5

      39a047da59a7fc1c27bc5f4dcef31350

    • SHA1

      134effc387741fef74af5bd7b92ca9f8d243d2ed

    • SHA256

      5056e5fb84287fe7c5f5300fe9eb8394c33219cfc896946e298621cb5d9de942

    • SHA512

      d385a161a0f3bbc6574a39c5d3e2f6f207c20e4997fca976e52c3b9e5164ec89f710c6d3cda9062b7dc24226c661ac4d5c29808ec2c43d328a653b6da59e833a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks