General

  • Target

    4579fbd482811a3bfa2df25df3e7a4de04b8fd436d237c9167bffe0d22905ac3

  • Size

    904KB

  • Sample

    241028-2fpeyaygll

  • MD5

    fb6eeadbf1ea6dfc8e59ec75309edb56

  • SHA1

    1d812c5f1e1f2438f4471d24d80b827ed7e207c5

  • SHA256

    4579fbd482811a3bfa2df25df3e7a4de04b8fd436d237c9167bffe0d22905ac3

  • SHA512

    846ab9727dc9692da7be5bbffca8ce673e217911e49b09aff959132a704235f71194f434f3f1ef3dc727d908f7db07b24076b489ef53f8fa3489aca532afba95

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4579fbd482811a3bfa2df25df3e7a4de04b8fd436d237c9167bffe0d22905ac3

    • Size

      904KB

    • MD5

      fb6eeadbf1ea6dfc8e59ec75309edb56

    • SHA1

      1d812c5f1e1f2438f4471d24d80b827ed7e207c5

    • SHA256

      4579fbd482811a3bfa2df25df3e7a4de04b8fd436d237c9167bffe0d22905ac3

    • SHA512

      846ab9727dc9692da7be5bbffca8ce673e217911e49b09aff959132a704235f71194f434f3f1ef3dc727d908f7db07b24076b489ef53f8fa3489aca532afba95

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks