General

  • Target

    b5186625b9a1ceb95c69b2be976fe6d449801416c70aa57b4211cfb895384227N

  • Size

    904KB

  • Sample

    241004-r6bawstfpb

  • MD5

    bec93a21a4e453130845bb1c99edfa40

  • SHA1

    3503e66a5318728e074f868f412a5645cca5cd03

  • SHA256

    b5186625b9a1ceb95c69b2be976fe6d449801416c70aa57b4211cfb895384227

  • SHA512

    ec16a28685d4ae51b8d6d4c98676c9e9b2f141a3d7ad85ca81d2da963c621697a5cb9c757942ff2137f2762064c8b3c634282b8e05aa89809513ca7081e8891c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5c:gh+ZkldoPK8YaKGc

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b5186625b9a1ceb95c69b2be976fe6d449801416c70aa57b4211cfb895384227N

    • Size

      904KB

    • MD5

      bec93a21a4e453130845bb1c99edfa40

    • SHA1

      3503e66a5318728e074f868f412a5645cca5cd03

    • SHA256

      b5186625b9a1ceb95c69b2be976fe6d449801416c70aa57b4211cfb895384227

    • SHA512

      ec16a28685d4ae51b8d6d4c98676c9e9b2f141a3d7ad85ca81d2da963c621697a5cb9c757942ff2137f2762064c8b3c634282b8e05aa89809513ca7081e8891c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5c:gh+ZkldoPK8YaKGc

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks