General

  • Target

    e0ab2be867265d582b5e4022658849ca045f5e76d60120a9ac16ae520ca83c4fN

  • Size

    904KB

  • Sample

    241030-jshh2szrap

  • MD5

    f0c5cfb27b1697eca3c1f808181edaa0

  • SHA1

    739fca570c3a4e1672077e27d534ed8b316d63dd

  • SHA256

    e0ab2be867265d582b5e4022658849ca045f5e76d60120a9ac16ae520ca83c4f

  • SHA512

    dcbabcf68ba6ab58a3516dfe22567fef0e85f075c1cd1bad3f6d771e07af096cd782c5b80baab7da5bcca47fd8f40b1564bd52d83067c25aa176c414dbc022f6

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e0ab2be867265d582b5e4022658849ca045f5e76d60120a9ac16ae520ca83c4fN

    • Size

      904KB

    • MD5

      f0c5cfb27b1697eca3c1f808181edaa0

    • SHA1

      739fca570c3a4e1672077e27d534ed8b316d63dd

    • SHA256

      e0ab2be867265d582b5e4022658849ca045f5e76d60120a9ac16ae520ca83c4f

    • SHA512

      dcbabcf68ba6ab58a3516dfe22567fef0e85f075c1cd1bad3f6d771e07af096cd782c5b80baab7da5bcca47fd8f40b1564bd52d83067c25aa176c414dbc022f6

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks