General

  • Target

    7d3dc6cb956548612c46966e59260ee81c72ccca259460eb19480c72c374bd6bN

  • Size

    904KB

  • Sample

    241021-rnhl9ayfjl

  • MD5

    162fe376eba08bc3101dc298277cbb90

  • SHA1

    d7230cd973988784ac5ff93ff722581a235130a4

  • SHA256

    7d3dc6cb956548612c46966e59260ee81c72ccca259460eb19480c72c374bd6b

  • SHA512

    33fc32260eaaeff67685c320907904a080b890775fe30856debbf7fa2c439c53886be77a84bec89de426bb67c73e33a480bf535ca4cc2db4773a7837dfafebe3

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      7d3dc6cb956548612c46966e59260ee81c72ccca259460eb19480c72c374bd6bN

    • Size

      904KB

    • MD5

      162fe376eba08bc3101dc298277cbb90

    • SHA1

      d7230cd973988784ac5ff93ff722581a235130a4

    • SHA256

      7d3dc6cb956548612c46966e59260ee81c72ccca259460eb19480c72c374bd6b

    • SHA512

      33fc32260eaaeff67685c320907904a080b890775fe30856debbf7fa2c439c53886be77a84bec89de426bb67c73e33a480bf535ca4cc2db4773a7837dfafebe3

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks