General

  • Target

    ec477b0ca9843f6fc5c160e2b458e49bc95724f93e5277ce67fc37db4299f0e9N

  • Size

    904KB

  • Sample

    240920-kr7bfsyaka

  • MD5

    2acc2c05e5e106ef3612cc08645f9760

  • SHA1

    2d44dbb1ab247308dd6a6072a1f2ac905142e212

  • SHA256

    ec477b0ca9843f6fc5c160e2b458e49bc95724f93e5277ce67fc37db4299f0e9

  • SHA512

    5b91819fade6173bbbc28372bed82053e993b158acda048dee6582b9246a7440b8df1c020cf064402a28d285901236ea6cffdac52cb42eace5363774ee81eace

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      ec477b0ca9843f6fc5c160e2b458e49bc95724f93e5277ce67fc37db4299f0e9N

    • Size

      904KB

    • MD5

      2acc2c05e5e106ef3612cc08645f9760

    • SHA1

      2d44dbb1ab247308dd6a6072a1f2ac905142e212

    • SHA256

      ec477b0ca9843f6fc5c160e2b458e49bc95724f93e5277ce67fc37db4299f0e9

    • SHA512

      5b91819fade6173bbbc28372bed82053e993b158acda048dee6582b9246a7440b8df1c020cf064402a28d285901236ea6cffdac52cb42eace5363774ee81eace

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks