General

  • Target

    777319e38e0c207666f5db10c48c9f0e6f89b561ac5ff07ce9a7f1aeda2c19a4N

  • Size

    904KB

  • Sample

    241005-cv9a8azepl

  • MD5

    eaf66a6846ec2744a2100c87b7fb9220

  • SHA1

    094031074ee117aae769083b74788e3875104913

  • SHA256

    777319e38e0c207666f5db10c48c9f0e6f89b561ac5ff07ce9a7f1aeda2c19a4

  • SHA512

    3a4ce6473951f69ee79d5ea1f1336d40e453f3041096ffeb8830f0611dc4acd0007a38bd9404241465be85c7165dfe4b3de7663684525734f553b4ade5dcf17f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      777319e38e0c207666f5db10c48c9f0e6f89b561ac5ff07ce9a7f1aeda2c19a4N

    • Size

      904KB

    • MD5

      eaf66a6846ec2744a2100c87b7fb9220

    • SHA1

      094031074ee117aae769083b74788e3875104913

    • SHA256

      777319e38e0c207666f5db10c48c9f0e6f89b561ac5ff07ce9a7f1aeda2c19a4

    • SHA512

      3a4ce6473951f69ee79d5ea1f1336d40e453f3041096ffeb8830f0611dc4acd0007a38bd9404241465be85c7165dfe4b3de7663684525734f553b4ade5dcf17f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5m:gh+ZkldoPK8YaKGm

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks