General

  • Target

    e1d127ffdf6cd55c4787efbd83c0f10ba0a4b8affb9114eaac4f1bd3b3cb8db8N

  • Size

    904KB

  • Sample

    241021-1lbwcszhmn

  • MD5

    0f213ccf36d948a2cf3bcd8443710c50

  • SHA1

    959698eec2e578e5a6111fd5072df516a0aabf9d

  • SHA256

    e1d127ffdf6cd55c4787efbd83c0f10ba0a4b8affb9114eaac4f1bd3b3cb8db8

  • SHA512

    495a39e3feb5319e7ace10d6f82e68aa419b1becaf8212063da5538fa6d0a5b0210cabd2a66f30ee2eabc411908d9c3157024050c5cb558550a028db63d866a5

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e1d127ffdf6cd55c4787efbd83c0f10ba0a4b8affb9114eaac4f1bd3b3cb8db8N

    • Size

      904KB

    • MD5

      0f213ccf36d948a2cf3bcd8443710c50

    • SHA1

      959698eec2e578e5a6111fd5072df516a0aabf9d

    • SHA256

      e1d127ffdf6cd55c4787efbd83c0f10ba0a4b8affb9114eaac4f1bd3b3cb8db8

    • SHA512

      495a39e3feb5319e7ace10d6f82e68aa419b1becaf8212063da5538fa6d0a5b0210cabd2a66f30ee2eabc411908d9c3157024050c5cb558550a028db63d866a5

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks