General

  • Target

    5d44caf6f78ea1f0580d0f6a56820219b530144968fceefa3d60fe91d21fe932

  • Size

    904KB

  • Sample

    240928-14gjkaycjp

  • MD5

    048f4c4a78a71e56b779fe30e42d4747

  • SHA1

    ef2037b924821431047ea6c1c4a64ddbca8aa723

  • SHA256

    5d44caf6f78ea1f0580d0f6a56820219b530144968fceefa3d60fe91d21fe932

  • SHA512

    e28dccb9bb7f60c687d065f587741168d4fcb6c71bab317b7374d89153bf7337845ac0bdb474055230c8b2e07ff9d98da363efb870e3418007bebbc2e5089e93

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      5d44caf6f78ea1f0580d0f6a56820219b530144968fceefa3d60fe91d21fe932

    • Size

      904KB

    • MD5

      048f4c4a78a71e56b779fe30e42d4747

    • SHA1

      ef2037b924821431047ea6c1c4a64ddbca8aa723

    • SHA256

      5d44caf6f78ea1f0580d0f6a56820219b530144968fceefa3d60fe91d21fe932

    • SHA512

      e28dccb9bb7f60c687d065f587741168d4fcb6c71bab317b7374d89153bf7337845ac0bdb474055230c8b2e07ff9d98da363efb870e3418007bebbc2e5089e93

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5C:gh+ZkldoPK8YaKGC

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks