General

  • Target

    9eccbd2336a3c849000fc0311d6f5f20dff87428443630674c1de3439bb0d996N

  • Size

    904KB

  • Sample

    241021-qaattawfpr

  • MD5

    c9a033a1d16e45b80ee1ce2216a1c5b0

  • SHA1

    ec30ffce01fe775b826c1617baeea7c46f29f11c

  • SHA256

    9eccbd2336a3c849000fc0311d6f5f20dff87428443630674c1de3439bb0d996

  • SHA512

    5d2812e8790ef52b8a7125b2a07db7c3f5da97ce3e731feae391a83979adf3df095d62b1a96ce1b69c6f4646b27cf9cd0a408a25ebe46db95dbcab66759e10ff

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5u:gh+ZkldoPK8YaKGu

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9eccbd2336a3c849000fc0311d6f5f20dff87428443630674c1de3439bb0d996N

    • Size

      904KB

    • MD5

      c9a033a1d16e45b80ee1ce2216a1c5b0

    • SHA1

      ec30ffce01fe775b826c1617baeea7c46f29f11c

    • SHA256

      9eccbd2336a3c849000fc0311d6f5f20dff87428443630674c1de3439bb0d996

    • SHA512

      5d2812e8790ef52b8a7125b2a07db7c3f5da97ce3e731feae391a83979adf3df095d62b1a96ce1b69c6f4646b27cf9cd0a408a25ebe46db95dbcab66759e10ff

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5u:gh+ZkldoPK8YaKGu

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks