General

  • Target

    34fccbfcaf2e1460514ce0f35e0af1d41d86f78b2c7cf7117613947203c41ddaN

  • Size

    904KB

  • Sample

    241005-rw14kavemm

  • MD5

    beaaf6a4a562eb37b348d72cbaa2d2a0

  • SHA1

    4fe7e248e26157ad9bfc2234288fba10b4736071

  • SHA256

    34fccbfcaf2e1460514ce0f35e0af1d41d86f78b2c7cf7117613947203c41dda

  • SHA512

    854a221383584dfbe6059ec6c7219bb07c237c30106d2b41803877e5c5823986e09227327abe7489924109a4d9a103590c4002ac206c64be9ceed9dc0d6ba9b7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      34fccbfcaf2e1460514ce0f35e0af1d41d86f78b2c7cf7117613947203c41ddaN

    • Size

      904KB

    • MD5

      beaaf6a4a562eb37b348d72cbaa2d2a0

    • SHA1

      4fe7e248e26157ad9bfc2234288fba10b4736071

    • SHA256

      34fccbfcaf2e1460514ce0f35e0af1d41d86f78b2c7cf7117613947203c41dda

    • SHA512

      854a221383584dfbe6059ec6c7219bb07c237c30106d2b41803877e5c5823986e09227327abe7489924109a4d9a103590c4002ac206c64be9ceed9dc0d6ba9b7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks