General

  • Target

    4a02c353702adb02d31511e9ced68d0378cbc1943b52fcd8dd1454f05a35b6b9

  • Size

    904KB

  • Sample

    241009-zg53zatdqq

  • MD5

    d188011d00f42eeb8c177fd98be71d51

  • SHA1

    65889fb3f18c5669c2b037ea4d346ffaf6535caa

  • SHA256

    4a02c353702adb02d31511e9ced68d0378cbc1943b52fcd8dd1454f05a35b6b9

  • SHA512

    c8b5cd8651d6a1bc4627ebcc318143d1786824eb689009e26cb11c3f164ca90571efbcc65abf3328aede13f600999e97fd2ee4308ed1d530df0e5e9b40ce2f18

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4a02c353702adb02d31511e9ced68d0378cbc1943b52fcd8dd1454f05a35b6b9

    • Size

      904KB

    • MD5

      d188011d00f42eeb8c177fd98be71d51

    • SHA1

      65889fb3f18c5669c2b037ea4d346ffaf6535caa

    • SHA256

      4a02c353702adb02d31511e9ced68d0378cbc1943b52fcd8dd1454f05a35b6b9

    • SHA512

      c8b5cd8651d6a1bc4627ebcc318143d1786824eb689009e26cb11c3f164ca90571efbcc65abf3328aede13f600999e97fd2ee4308ed1d530df0e5e9b40ce2f18

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5J:gh+ZkldoPK8YaKGJ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks