General

  • Target

    074793ae217a4f29b8b02af62c2b587a7fe45f8348c2613ea1dea1623c26ca5c

  • Size

    903KB

  • Sample

    241019-t5d2haxhqk

  • MD5

    eb95e2afada77952e60d083863e92b10

  • SHA1

    5ff120fd751c91e067c6c0e8069794719daa933d

  • SHA256

    074793ae217a4f29b8b02af62c2b587a7fe45f8348c2613ea1dea1623c26ca5c

  • SHA512

    c9207ed35cd9f3bea085e64f6fffe0ad181687b2df2215d5db69c382e9c71718545cb345d93ee23c0e4c92c579d1bc2ac7b9a835a136ae73533355cbf2cf7fc0

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      074793ae217a4f29b8b02af62c2b587a7fe45f8348c2613ea1dea1623c26ca5c

    • Size

      903KB

    • MD5

      eb95e2afada77952e60d083863e92b10

    • SHA1

      5ff120fd751c91e067c6c0e8069794719daa933d

    • SHA256

      074793ae217a4f29b8b02af62c2b587a7fe45f8348c2613ea1dea1623c26ca5c

    • SHA512

      c9207ed35cd9f3bea085e64f6fffe0ad181687b2df2215d5db69c382e9c71718545cb345d93ee23c0e4c92c579d1bc2ac7b9a835a136ae73533355cbf2cf7fc0

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks