General

  • Target

    62859bbb23260a4faab8ed16dd8ced2c008f4a952bd9cebceffd7bdb05731ddfN

  • Size

    904KB

  • Sample

    240930-hpy6yswcle

  • MD5

    8a87873b2d0a0c3b9142f64674b460c0

  • SHA1

    7aec1c080191a06f61a62f59ea7e9bf88f70b4bc

  • SHA256

    62859bbb23260a4faab8ed16dd8ced2c008f4a952bd9cebceffd7bdb05731ddf

  • SHA512

    053b03b3c2f2e2ee902fdb1659f459a978bd9de0b3a27b84e41cfe28c5143d9bdb1c064a80c05c6eef8a54895f330957aa45d039fd751ac49bdf0e2f3a2697c1

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      62859bbb23260a4faab8ed16dd8ced2c008f4a952bd9cebceffd7bdb05731ddfN

    • Size

      904KB

    • MD5

      8a87873b2d0a0c3b9142f64674b460c0

    • SHA1

      7aec1c080191a06f61a62f59ea7e9bf88f70b4bc

    • SHA256

      62859bbb23260a4faab8ed16dd8ced2c008f4a952bd9cebceffd7bdb05731ddf

    • SHA512

      053b03b3c2f2e2ee902fdb1659f459a978bd9de0b3a27b84e41cfe28c5143d9bdb1c064a80c05c6eef8a54895f330957aa45d039fd751ac49bdf0e2f3a2697c1

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks