General

  • Target

    2432ace3222b6ae0927dabd81300644df4931ea6827bca7a30aca717aeb592a6N

  • Size

    904KB

  • Sample

    240916-3vwcgawdpc

  • MD5

    8665aca97cc8b376a094ab7b0bc87fa0

  • SHA1

    b487117fc60d9f78e6559ca7331352e93be56c58

  • SHA256

    2432ace3222b6ae0927dabd81300644df4931ea6827bca7a30aca717aeb592a6

  • SHA512

    5c5e822d5c702709acd3c673f188a18bccd740d68d850ff28bea27075db537b7f6ceade897375a819270998fbedbb22d129b6326ae37ba8d21d6398137793383

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa53:gh+ZkldoPK8YaKG3

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2432ace3222b6ae0927dabd81300644df4931ea6827bca7a30aca717aeb592a6N

    • Size

      904KB

    • MD5

      8665aca97cc8b376a094ab7b0bc87fa0

    • SHA1

      b487117fc60d9f78e6559ca7331352e93be56c58

    • SHA256

      2432ace3222b6ae0927dabd81300644df4931ea6827bca7a30aca717aeb592a6

    • SHA512

      5c5e822d5c702709acd3c673f188a18bccd740d68d850ff28bea27075db537b7f6ceade897375a819270998fbedbb22d129b6326ae37ba8d21d6398137793383

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa53:gh+ZkldoPK8YaKG3

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks