General

  • Target

    395482dd9820f7de6384710499e241ec62032698ca24569a02b460ca3668a976N

  • Size

    904KB

  • Sample

    241106-szc2ksvnhl

  • MD5

    627509b850cba2b88925efefa4f54790

  • SHA1

    7f862beb7f843929a0fc86db0faf5d8e23a741de

  • SHA256

    395482dd9820f7de6384710499e241ec62032698ca24569a02b460ca3668a976

  • SHA512

    9a42ae04d65d9201d8a3f85a644ea9c5aca54c4e8e043c5d5387b44761092371e15d5c9932cc8f4ab3a72ee927312ccb3893cd2049350b7226a693a240bffdb2

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      395482dd9820f7de6384710499e241ec62032698ca24569a02b460ca3668a976N

    • Size

      904KB

    • MD5

      627509b850cba2b88925efefa4f54790

    • SHA1

      7f862beb7f843929a0fc86db0faf5d8e23a741de

    • SHA256

      395482dd9820f7de6384710499e241ec62032698ca24569a02b460ca3668a976

    • SHA512

      9a42ae04d65d9201d8a3f85a644ea9c5aca54c4e8e043c5d5387b44761092371e15d5c9932cc8f4ab3a72ee927312ccb3893cd2049350b7226a693a240bffdb2

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5H:gh+ZkldoPK8YaKGH

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks