General

  • Target

    00532ccc57d4b581bb67b602bf25e854b0aeebdef08f991dbd703c77fe5b2dccN

  • Size

    904KB

  • Sample

    240916-3ka9jsvhpc

  • MD5

    b22a55703e2f3971dec9149683071840

  • SHA1

    29af2942e00e869e679589a634fa0015ba143304

  • SHA256

    00532ccc57d4b581bb67b602bf25e854b0aeebdef08f991dbd703c77fe5b2dcc

  • SHA512

    7ea6dca9f5f4f7a5ec14489c3dfbb584a7ffedbc1ba092f1616d1be17194917f3ea13292e39f1f32320ac43ac832491c8ab8da73333df731fd8cd0c9439bbbad

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      00532ccc57d4b581bb67b602bf25e854b0aeebdef08f991dbd703c77fe5b2dccN

    • Size

      904KB

    • MD5

      b22a55703e2f3971dec9149683071840

    • SHA1

      29af2942e00e869e679589a634fa0015ba143304

    • SHA256

      00532ccc57d4b581bb67b602bf25e854b0aeebdef08f991dbd703c77fe5b2dcc

    • SHA512

      7ea6dca9f5f4f7a5ec14489c3dfbb584a7ffedbc1ba092f1616d1be17194917f3ea13292e39f1f32320ac43ac832491c8ab8da73333df731fd8cd0c9439bbbad

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks