General

  • Target

    576100cd01e86ec8b994acad9f9fd7d8843c01872df8e3533c4cd4b9cf8a4d45N

  • Size

    904KB

  • Sample

    240927-jr1y1asdpn

  • MD5

    da0462b5a19bc9becf18bcfd6dbde9b0

  • SHA1

    9f2451ce46958e055a130e6b91ea7c2d47fea749

  • SHA256

    576100cd01e86ec8b994acad9f9fd7d8843c01872df8e3533c4cd4b9cf8a4d45

  • SHA512

    012a9882394e0f1e394535aa717173256e9f846574f8a9b690286ccb977beda5fa03d2af2d875342bf0c6c1660f544babcd712c69f7fdbf07814240b03835048

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Q:gh+ZkldoPK8YaKGQ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      576100cd01e86ec8b994acad9f9fd7d8843c01872df8e3533c4cd4b9cf8a4d45N

    • Size

      904KB

    • MD5

      da0462b5a19bc9becf18bcfd6dbde9b0

    • SHA1

      9f2451ce46958e055a130e6b91ea7c2d47fea749

    • SHA256

      576100cd01e86ec8b994acad9f9fd7d8843c01872df8e3533c4cd4b9cf8a4d45

    • SHA512

      012a9882394e0f1e394535aa717173256e9f846574f8a9b690286ccb977beda5fa03d2af2d875342bf0c6c1660f544babcd712c69f7fdbf07814240b03835048

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Q:gh+ZkldoPK8YaKGQ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks