General

  • Target

    25c38d058357a2adccbd3cfa2cb488690e038d40770fc5d9c6587a9836904fceN

  • Size

    903KB

  • Sample

    240919-1p7gfasdng

  • MD5

    5fa598ea328220f7f93d0632ade97e90

  • SHA1

    2bafc7477ee4a10cfd7ce9a2be777694bcec6c63

  • SHA256

    25c38d058357a2adccbd3cfa2cb488690e038d40770fc5d9c6587a9836904fce

  • SHA512

    42206fdf80e54a9f94ecbd64f02f54d56b5ff37dac75c38bb32eb608c5536596e31d4942f9def12b5bdb7f4da28f9c428ebf52f2c9a92155da444fc32ff49636

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      25c38d058357a2adccbd3cfa2cb488690e038d40770fc5d9c6587a9836904fceN

    • Size

      903KB

    • MD5

      5fa598ea328220f7f93d0632ade97e90

    • SHA1

      2bafc7477ee4a10cfd7ce9a2be777694bcec6c63

    • SHA256

      25c38d058357a2adccbd3cfa2cb488690e038d40770fc5d9c6587a9836904fce

    • SHA512

      42206fdf80e54a9f94ecbd64f02f54d56b5ff37dac75c38bb32eb608c5536596e31d4942f9def12b5bdb7f4da28f9c428ebf52f2c9a92155da444fc32ff49636

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks