General

  • Target

    b33c75342e34d02fc01c030d82357a7dc9514e723bf78af854758063dfde1484N

  • Size

    904KB

  • Sample

    241021-w4svda1bjc

  • MD5

    17ea9f21257e0e9033c8cf0f00391700

  • SHA1

    dffec40a90e9de6d066fd13163041e7e175e2e04

  • SHA256

    b33c75342e34d02fc01c030d82357a7dc9514e723bf78af854758063dfde1484

  • SHA512

    f05664211e845ff0434d1a79a1f88845f3df4f797a92572512af97a75d1c42c5c8fa8df13aa1616f9b0221c543f537fa055db8b0825a636e6d4ff46af10b77aa

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b33c75342e34d02fc01c030d82357a7dc9514e723bf78af854758063dfde1484N

    • Size

      904KB

    • MD5

      17ea9f21257e0e9033c8cf0f00391700

    • SHA1

      dffec40a90e9de6d066fd13163041e7e175e2e04

    • SHA256

      b33c75342e34d02fc01c030d82357a7dc9514e723bf78af854758063dfde1484

    • SHA512

      f05664211e845ff0434d1a79a1f88845f3df4f797a92572512af97a75d1c42c5c8fa8df13aa1616f9b0221c543f537fa055db8b0825a636e6d4ff46af10b77aa

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks