General

  • Target

    379c60bfafa8d4767bb07714c14015d1d885037b3c272b7aa3dd6a1810a5ed34

  • Size

    904KB

  • Sample

    241020-zjy3fa1djj

  • MD5

    074a5be3d163a0abdb00acfdfb1f8d21

  • SHA1

    fad6d76dff766d13b36b3ce9ea69087d39bec957

  • SHA256

    379c60bfafa8d4767bb07714c14015d1d885037b3c272b7aa3dd6a1810a5ed34

  • SHA512

    ae25225cfae671764989d3292a2779f1670ab42d191cc9acdac3e3284f277286a62244c552dd5fa16df23aa5db41a62382348b0d9c829da85e6005ed58a33609

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      379c60bfafa8d4767bb07714c14015d1d885037b3c272b7aa3dd6a1810a5ed34

    • Size

      904KB

    • MD5

      074a5be3d163a0abdb00acfdfb1f8d21

    • SHA1

      fad6d76dff766d13b36b3ce9ea69087d39bec957

    • SHA256

      379c60bfafa8d4767bb07714c14015d1d885037b3c272b7aa3dd6a1810a5ed34

    • SHA512

      ae25225cfae671764989d3292a2779f1670ab42d191cc9acdac3e3284f277286a62244c552dd5fa16df23aa5db41a62382348b0d9c829da85e6005ed58a33609

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5g:gh+ZkldoPK8YaKGg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks