General

  • Target

    04f49a8bf4987e7173d63182770c1f1a9f002f0b7e5f9a04bb6c36f2928915a5

  • Size

    904KB

  • Sample

    240925-wvkgmsshnh

  • MD5

    a9e66e31d6de16efe1ee997161e8b49d

  • SHA1

    fa72bbea2f965fcb3dcf76eb0dd81b41c84a92e5

  • SHA256

    04f49a8bf4987e7173d63182770c1f1a9f002f0b7e5f9a04bb6c36f2928915a5

  • SHA512

    29133c45bd17bb15b768b692a9aa61b5ab97e01fe73c40752e9c338ec3ce439bfef2719b776314e2f65e8d53d2495ad2dee9ecf9f6517fd59b5c1d8df920ec1d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      04f49a8bf4987e7173d63182770c1f1a9f002f0b7e5f9a04bb6c36f2928915a5

    • Size

      904KB

    • MD5

      a9e66e31d6de16efe1ee997161e8b49d

    • SHA1

      fa72bbea2f965fcb3dcf76eb0dd81b41c84a92e5

    • SHA256

      04f49a8bf4987e7173d63182770c1f1a9f002f0b7e5f9a04bb6c36f2928915a5

    • SHA512

      29133c45bd17bb15b768b692a9aa61b5ab97e01fe73c40752e9c338ec3ce439bfef2719b776314e2f65e8d53d2495ad2dee9ecf9f6517fd59b5c1d8df920ec1d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks