General

  • Target

    27a3f67083e3c2739aa5ef373eb1b70129315a912ab8236dec27c53ab14672ffN

  • Size

    904KB

  • Sample

    240928-wedn6aybnn

  • MD5

    23825abaa3e3ef1d697a4e8455176ec0

  • SHA1

    b45069bc9ec4a441e286ca5d6b5e0fcee2693567

  • SHA256

    27a3f67083e3c2739aa5ef373eb1b70129315a912ab8236dec27c53ab14672ff

  • SHA512

    3909df9e53fb7ce14781d6bf5bd2287a803ed5c7139bfbbda630df3770ef6e140f0d3e1ee47a26731bf9c7b61eb12f085da3d1f49d1e2384886572ed850cf444

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      27a3f67083e3c2739aa5ef373eb1b70129315a912ab8236dec27c53ab14672ffN

    • Size

      904KB

    • MD5

      23825abaa3e3ef1d697a4e8455176ec0

    • SHA1

      b45069bc9ec4a441e286ca5d6b5e0fcee2693567

    • SHA256

      27a3f67083e3c2739aa5ef373eb1b70129315a912ab8236dec27c53ab14672ff

    • SHA512

      3909df9e53fb7ce14781d6bf5bd2287a803ed5c7139bfbbda630df3770ef6e140f0d3e1ee47a26731bf9c7b61eb12f085da3d1f49d1e2384886572ed850cf444

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks