General

  • Target

    VirTool.Win32.AutInject.pz-fae2f21a22a7a2bdaa2cc2b1f4ad879166df5e2cacb3b1842084b50c798729d2N

  • Size

    904KB

  • Sample

    240915-ytzlaa1ara

  • MD5

    2ac36ccc36d0b58ef61b34bc3c542250

  • SHA1

    38b20bb3446475da70ad95933c19895f2101cea8

  • SHA256

    fae2f21a22a7a2bdaa2cc2b1f4ad879166df5e2cacb3b1842084b50c798729d2

  • SHA512

    30d41ef481707c4b06ebbc7abebb1f03f22852d52d79f6334300eb514eae40de44d6eebb1f5987f1ec1ccf0486d6223c7b8e3fe3ce83d04edb565251d1fcab28

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5j:gh+ZkldoPK8YaKGj

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      VirTool.Win32.AutInject.pz-fae2f21a22a7a2bdaa2cc2b1f4ad879166df5e2cacb3b1842084b50c798729d2N

    • Size

      904KB

    • MD5

      2ac36ccc36d0b58ef61b34bc3c542250

    • SHA1

      38b20bb3446475da70ad95933c19895f2101cea8

    • SHA256

      fae2f21a22a7a2bdaa2cc2b1f4ad879166df5e2cacb3b1842084b50c798729d2

    • SHA512

      30d41ef481707c4b06ebbc7abebb1f03f22852d52d79f6334300eb514eae40de44d6eebb1f5987f1ec1ccf0486d6223c7b8e3fe3ce83d04edb565251d1fcab28

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5j:gh+ZkldoPK8YaKGj

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks