General

  • Target

    bounty-2479168337239361

  • Size

    904KB

  • Sample

    241016-z81bssxbpp

  • MD5

    21f9aa4b8e01f8b6f9421cf41d01caa2

  • SHA1

    f92a495936aa1b32a1d7224f0606520242d1c62b

  • SHA256

    e5e78b90dfa67c5ce67d5d271bdcd59d55aef53625660adc3564414a30f8047d

  • SHA512

    9cf0e79f8dd5d407e6a46306ae6cd8388fa662b972bbfaf1f04964068b2fc1b1f419e7be9c31f450f0c9ec1fb6ec5eabd2f2a641b1892a2b19ad158bf3251a44

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bounty-2479168337239361

    • Size

      904KB

    • MD5

      21f9aa4b8e01f8b6f9421cf41d01caa2

    • SHA1

      f92a495936aa1b32a1d7224f0606520242d1c62b

    • SHA256

      e5e78b90dfa67c5ce67d5d271bdcd59d55aef53625660adc3564414a30f8047d

    • SHA512

      9cf0e79f8dd5d407e6a46306ae6cd8388fa662b972bbfaf1f04964068b2fc1b1f419e7be9c31f450f0c9ec1fb6ec5eabd2f2a641b1892a2b19ad158bf3251a44

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5X:gh+ZkldoPK8YaKGX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks