General

  • Target

    d18a6d78d39469f5e68f58039e519460N

  • Size

    904KB

  • Sample

    240914-vqqx7awbld

  • MD5

    d18a6d78d39469f5e68f58039e519460

  • SHA1

    7a2113a980d2237c1f8dae204451ea8e3fc34747

  • SHA256

    13037e1bd85ec984093312fe5ba3fb33225c2d923639e6dc64dad004b88053a7

  • SHA512

    88e90d032adf8e88ffce822e5f948977efd6972dbd16272d7d3f9da76aa92889c52cb317418885f7ed70cbede0bc313f924bfebab825985baa4f0eb4355616d1

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d18a6d78d39469f5e68f58039e519460N

    • Size

      904KB

    • MD5

      d18a6d78d39469f5e68f58039e519460

    • SHA1

      7a2113a980d2237c1f8dae204451ea8e3fc34747

    • SHA256

      13037e1bd85ec984093312fe5ba3fb33225c2d923639e6dc64dad004b88053a7

    • SHA512

      88e90d032adf8e88ffce822e5f948977efd6972dbd16272d7d3f9da76aa92889c52cb317418885f7ed70cbede0bc313f924bfebab825985baa4f0eb4355616d1

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks