General

  • Target

    15f640d4736c44aecf3aa98fc28168532c9afc65917a1d954100cc69ec6bfaf5

  • Size

    904KB

  • Sample

    240924-zxnhvsydjb

  • MD5

    4303a2abbef8534cf1e65142b5ea8e2a

  • SHA1

    4800bf82d99ca3acb6c0934a75cebc3bf59d50ec

  • SHA256

    15f640d4736c44aecf3aa98fc28168532c9afc65917a1d954100cc69ec6bfaf5

  • SHA512

    c6975ab08c8bd3cc5980cec1be020a5875767e11871717bde4d1c0ba0e5c944f0255973dbc731303a04ad030ee7590382f8ece196dc8b3371c9b6bb6b83d94c3

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      15f640d4736c44aecf3aa98fc28168532c9afc65917a1d954100cc69ec6bfaf5

    • Size

      904KB

    • MD5

      4303a2abbef8534cf1e65142b5ea8e2a

    • SHA1

      4800bf82d99ca3acb6c0934a75cebc3bf59d50ec

    • SHA256

      15f640d4736c44aecf3aa98fc28168532c9afc65917a1d954100cc69ec6bfaf5

    • SHA512

      c6975ab08c8bd3cc5980cec1be020a5875767e11871717bde4d1c0ba0e5c944f0255973dbc731303a04ad030ee7590382f8ece196dc8b3371c9b6bb6b83d94c3

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks