General

  • Target

    d4f32f3045af24188531287220b9a8688f65dff38bc6514d1c49bdd8ef0771a4N

  • Size

    904KB

  • Sample

    241015-n34lgsxapk

  • MD5

    ca0f661c0153d93a1848267b64dc16b0

  • SHA1

    765c8fea74897312e517af482c595c1e51cbc787

  • SHA256

    d4f32f3045af24188531287220b9a8688f65dff38bc6514d1c49bdd8ef0771a4

  • SHA512

    beb6e51c8019bcfe5c85f24a53ee2fb7fe58400ac8959cd503e5ecb1c488904fe225e2990013a60c499d306a61180270775b4b5ab4313975a5fae0b1aa634500

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d4f32f3045af24188531287220b9a8688f65dff38bc6514d1c49bdd8ef0771a4N

    • Size

      904KB

    • MD5

      ca0f661c0153d93a1848267b64dc16b0

    • SHA1

      765c8fea74897312e517af482c595c1e51cbc787

    • SHA256

      d4f32f3045af24188531287220b9a8688f65dff38bc6514d1c49bdd8ef0771a4

    • SHA512

      beb6e51c8019bcfe5c85f24a53ee2fb7fe58400ac8959cd503e5ecb1c488904fe225e2990013a60c499d306a61180270775b4b5ab4313975a5fae0b1aa634500

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5E:gh+ZkldoPK8YaKGE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks