General

  • Target

    8c296181e92295ca5d1280cd225542d9d21d954b3b9a1e80ef18a97d8d4561ae

  • Size

    904KB

  • Sample

    241009-25g26a1bjh

  • MD5

    e961fb0f7edd972663fe779f1ff91457

  • SHA1

    cfb738b69d1632681c9c7983d108b85e78f964d3

  • SHA256

    8c296181e92295ca5d1280cd225542d9d21d954b3b9a1e80ef18a97d8d4561ae

  • SHA512

    89aa24341efe5b25c4231614c04f7d1f26dec589cd03045ea567be90782e0345bc250351ccfd2ee05b4badfe2f9616c6c6fc65512b7aca456b91ff8ef09ae00d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa55:gh+ZkldoPK8YaKG5

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8c296181e92295ca5d1280cd225542d9d21d954b3b9a1e80ef18a97d8d4561ae

    • Size

      904KB

    • MD5

      e961fb0f7edd972663fe779f1ff91457

    • SHA1

      cfb738b69d1632681c9c7983d108b85e78f964d3

    • SHA256

      8c296181e92295ca5d1280cd225542d9d21d954b3b9a1e80ef18a97d8d4561ae

    • SHA512

      89aa24341efe5b25c4231614c04f7d1f26dec589cd03045ea567be90782e0345bc250351ccfd2ee05b4badfe2f9616c6c6fc65512b7aca456b91ff8ef09ae00d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa55:gh+ZkldoPK8YaKG5

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks