General

  • Target

    ec169f33ec0aae6c4b851795fbb4d0ef726d9f750a4f3eed0e83ee251b890861N

  • Size

    904KB

  • Sample

    241030-njajas1lew

  • MD5

    42bec568c1dbedc1d188798689f20240

  • SHA1

    9552f2ae8e9391f7e8d1c8a36f2b4f519d5e5009

  • SHA256

    ec169f33ec0aae6c4b851795fbb4d0ef726d9f750a4f3eed0e83ee251b890861

  • SHA512

    47102d7688e650d311259d9123ab52cbf92c7e13847b80e00059a894ca52c7cdbe8ddbdf63f2c7b4438a72c9fdb09bd30379d9eecef111662226eedbff69bea7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      ec169f33ec0aae6c4b851795fbb4d0ef726d9f750a4f3eed0e83ee251b890861N

    • Size

      904KB

    • MD5

      42bec568c1dbedc1d188798689f20240

    • SHA1

      9552f2ae8e9391f7e8d1c8a36f2b4f519d5e5009

    • SHA256

      ec169f33ec0aae6c4b851795fbb4d0ef726d9f750a4f3eed0e83ee251b890861

    • SHA512

      47102d7688e650d311259d9123ab52cbf92c7e13847b80e00059a894ca52c7cdbe8ddbdf63f2c7b4438a72c9fdb09bd30379d9eecef111662226eedbff69bea7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5f:gh+ZkldoPK8YaKGf

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks