General

  • Target

    d8d08cdd64f47914080f6a97b8d8a51b57f28eabb635acf5354df582eaae1730N

  • Size

    904KB

  • Sample

    241002-cydnqaseqr

  • MD5

    ed0bfdc256508fcc811cff5372027290

  • SHA1

    10d18f3028da503c23ab14626c737cbd620b6cff

  • SHA256

    d8d08cdd64f47914080f6a97b8d8a51b57f28eabb635acf5354df582eaae1730

  • SHA512

    3388174f50c623b94d6838dff1b2a0cb6e90b42d31f5611f218076951052bcfe08881de7870d7b92a777ce37155bb31d7e7b96d0985c9be5dc157a6f0ce977eb

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d8d08cdd64f47914080f6a97b8d8a51b57f28eabb635acf5354df582eaae1730N

    • Size

      904KB

    • MD5

      ed0bfdc256508fcc811cff5372027290

    • SHA1

      10d18f3028da503c23ab14626c737cbd620b6cff

    • SHA256

      d8d08cdd64f47914080f6a97b8d8a51b57f28eabb635acf5354df582eaae1730

    • SHA512

      3388174f50c623b94d6838dff1b2a0cb6e90b42d31f5611f218076951052bcfe08881de7870d7b92a777ce37155bb31d7e7b96d0985c9be5dc157a6f0ce977eb

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5I:gh+ZkldoPK8YaKGI

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks