General

  • Target

    961eed24aa9de871ed77b4e176a3e4c10462d494d47056de04ca507c13629f08N

  • Size

    904KB

  • Sample

    241030-zlkyla1dmp

  • MD5

    84aea4b9a496aeb2380f0d8ac3c7e200

  • SHA1

    2d0654ba2a42e21a136894050b04d49e10e35567

  • SHA256

    961eed24aa9de871ed77b4e176a3e4c10462d494d47056de04ca507c13629f08

  • SHA512

    3101c70bec48f7969912d1ffcf6eaf51aab2967caedb3801e8d30450ac3ce7a67fc2a0fce671b479ba6e6f9ff53d30c4c293bfd35b838b3109e3f46fd6368bce

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5i:gh+ZkldoPK8YaKGi

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      961eed24aa9de871ed77b4e176a3e4c10462d494d47056de04ca507c13629f08N

    • Size

      904KB

    • MD5

      84aea4b9a496aeb2380f0d8ac3c7e200

    • SHA1

      2d0654ba2a42e21a136894050b04d49e10e35567

    • SHA256

      961eed24aa9de871ed77b4e176a3e4c10462d494d47056de04ca507c13629f08

    • SHA512

      3101c70bec48f7969912d1ffcf6eaf51aab2967caedb3801e8d30450ac3ce7a67fc2a0fce671b479ba6e6f9ff53d30c4c293bfd35b838b3109e3f46fd6368bce

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5i:gh+ZkldoPK8YaKGi

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks