General

  • Target

    6db70ecb246a30d06067e398eec2d811b3641cf2bdf849bd749d8ed3f100f5df

  • Size

    903KB

  • Sample

    241020-277etsxfkp

  • MD5

    4aaff9e7a07d8b1b77f4fa5175a2fd56

  • SHA1

    284f41a2c6b3aa6e284f2acf540933f027213567

  • SHA256

    6db70ecb246a30d06067e398eec2d811b3641cf2bdf849bd749d8ed3f100f5df

  • SHA512

    8271a6efd09901977b68989c070f1baf7dffce222428e7a3aaf721311f0aaa58888606fea7907d6e3cd6426efff142800cff8f7808e00e2554439162176498aa

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6db70ecb246a30d06067e398eec2d811b3641cf2bdf849bd749d8ed3f100f5df

    • Size

      903KB

    • MD5

      4aaff9e7a07d8b1b77f4fa5175a2fd56

    • SHA1

      284f41a2c6b3aa6e284f2acf540933f027213567

    • SHA256

      6db70ecb246a30d06067e398eec2d811b3641cf2bdf849bd749d8ed3f100f5df

    • SHA512

      8271a6efd09901977b68989c070f1baf7dffce222428e7a3aaf721311f0aaa58888606fea7907d6e3cd6426efff142800cff8f7808e00e2554439162176498aa

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks