General

  • Target

    f81bc654a2c4b23bc3a219cfbe38f28d73bb8b89f65e32e5177689fb30bc7669

  • Size

    904KB

  • Sample

    241010-d9btyawhqd

  • MD5

    7d3cedcfdcc4e74e2bfaaf9251d91881

  • SHA1

    79068c15c1bdcbb29816a804d53cb918951996cf

  • SHA256

    f81bc654a2c4b23bc3a219cfbe38f28d73bb8b89f65e32e5177689fb30bc7669

  • SHA512

    a4832fd28791820cf1c81e122a98b0c13f94b8ac59561a4b2e8d466dabf7ef2194c8b8a1086220e11fa731d37284b8ad670198978b11fb553d43addc3aaba722

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f81bc654a2c4b23bc3a219cfbe38f28d73bb8b89f65e32e5177689fb30bc7669

    • Size

      904KB

    • MD5

      7d3cedcfdcc4e74e2bfaaf9251d91881

    • SHA1

      79068c15c1bdcbb29816a804d53cb918951996cf

    • SHA256

      f81bc654a2c4b23bc3a219cfbe38f28d73bb8b89f65e32e5177689fb30bc7669

    • SHA512

      a4832fd28791820cf1c81e122a98b0c13f94b8ac59561a4b2e8d466dabf7ef2194c8b8a1086220e11fa731d37284b8ad670198978b11fb553d43addc3aaba722

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa54:gh+ZkldoPK8YaKG4

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks