General

  • Target

    03543f25aaaa96c4bcd62971b9ff3dffbfc83f91f1317695ad7f61241383402fN

  • Size

    904KB

  • Sample

    240927-j2gywawbnd

  • MD5

    7f58a9f25eb33f4fb46c1810dd9197c0

  • SHA1

    699cf565e123c8bbf66d346f09c68804c5a53023

  • SHA256

    03543f25aaaa96c4bcd62971b9ff3dffbfc83f91f1317695ad7f61241383402f

  • SHA512

    37aea18ed68e5bb535702a76177476a9f04ff8aa0de582ded33f3141228ac09d5e6632a852b5d149ecacee0d790762d5e381cd77fd90c6f2806f82c56c92878c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      03543f25aaaa96c4bcd62971b9ff3dffbfc83f91f1317695ad7f61241383402fN

    • Size

      904KB

    • MD5

      7f58a9f25eb33f4fb46c1810dd9197c0

    • SHA1

      699cf565e123c8bbf66d346f09c68804c5a53023

    • SHA256

      03543f25aaaa96c4bcd62971b9ff3dffbfc83f91f1317695ad7f61241383402f

    • SHA512

      37aea18ed68e5bb535702a76177476a9f04ff8aa0de582ded33f3141228ac09d5e6632a852b5d149ecacee0d790762d5e381cd77fd90c6f2806f82c56c92878c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks