General

  • Target

    80f04781bdc1dc8df57d610eed8845afe2fdad7a9b8ccd1f85308b4244b5f73bN

  • Size

    904KB

  • Sample

    241009-vtjnaatgpc

  • MD5

    f419dd1466aa024e7d16610adcc03ab0

  • SHA1

    03bcd8ca7856854296a9747e1f441e89382c45bf

  • SHA256

    80f04781bdc1dc8df57d610eed8845afe2fdad7a9b8ccd1f85308b4244b5f73b

  • SHA512

    7642acbffc6f9c8d5614adec245793fc0a387e26f7e84fdd25239f7bc5f154f079f8fe359cb17d6185ab4f5f2d3527bb27d8fb83d54a50dea75ea67e4659a7df

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      80f04781bdc1dc8df57d610eed8845afe2fdad7a9b8ccd1f85308b4244b5f73bN

    • Size

      904KB

    • MD5

      f419dd1466aa024e7d16610adcc03ab0

    • SHA1

      03bcd8ca7856854296a9747e1f441e89382c45bf

    • SHA256

      80f04781bdc1dc8df57d610eed8845afe2fdad7a9b8ccd1f85308b4244b5f73b

    • SHA512

      7642acbffc6f9c8d5614adec245793fc0a387e26f7e84fdd25239f7bc5f154f079f8fe359cb17d6185ab4f5f2d3527bb27d8fb83d54a50dea75ea67e4659a7df

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks