General

  • Target

    72eec30e4610a2c3dc944e24d629b09e02c57ca11a06c2cc6f6ce8f295bd0345N

  • Size

    904KB

  • Sample

    241005-d1rtsssglk

  • MD5

    7f3a0b6aab1311d751ee24a11738c630

  • SHA1

    dbbe2a71018c11347c4a8b7fe8126c3b778fe79c

  • SHA256

    72eec30e4610a2c3dc944e24d629b09e02c57ca11a06c2cc6f6ce8f295bd0345

  • SHA512

    81de0935ad605548882f75ed27a250fffc9d0af1dde62ef87edb9931430c7aa4ecc349eadd4cd81e59a0d430505bdec7d7589739b5dc45f1d90f59a97867a03c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      72eec30e4610a2c3dc944e24d629b09e02c57ca11a06c2cc6f6ce8f295bd0345N

    • Size

      904KB

    • MD5

      7f3a0b6aab1311d751ee24a11738c630

    • SHA1

      dbbe2a71018c11347c4a8b7fe8126c3b778fe79c

    • SHA256

      72eec30e4610a2c3dc944e24d629b09e02c57ca11a06c2cc6f6ce8f295bd0345

    • SHA512

      81de0935ad605548882f75ed27a250fffc9d0af1dde62ef87edb9931430c7aa4ecc349eadd4cd81e59a0d430505bdec7d7589739b5dc45f1d90f59a97867a03c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks