General

  • Target

    aae0af048ba4ae6ef675390095575ca8ffe492f47a63efb2b7ea94efab8cde87N

  • Size

    904KB

  • Sample

    241108-n4jbya1ldz

  • MD5

    a6f2ff91e3f81dae2c89f8e4eb9b7660

  • SHA1

    06dfdbbc3aa6c4af5a04c36d4b791c3a5bf125dd

  • SHA256

    aae0af048ba4ae6ef675390095575ca8ffe492f47a63efb2b7ea94efab8cde87

  • SHA512

    fb8fa06519e7545d8fc711fc4f1d58308a1d65a50ba2e2883829f6b767da156aaa6b5986a98f73c93b88ca08b342f24be185060e5e3bd93f5f49550f36585d8e

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5U:gh+ZkldoPK8YaKGU

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      aae0af048ba4ae6ef675390095575ca8ffe492f47a63efb2b7ea94efab8cde87N

    • Size

      904KB

    • MD5

      a6f2ff91e3f81dae2c89f8e4eb9b7660

    • SHA1

      06dfdbbc3aa6c4af5a04c36d4b791c3a5bf125dd

    • SHA256

      aae0af048ba4ae6ef675390095575ca8ffe492f47a63efb2b7ea94efab8cde87

    • SHA512

      fb8fa06519e7545d8fc711fc4f1d58308a1d65a50ba2e2883829f6b767da156aaa6b5986a98f73c93b88ca08b342f24be185060e5e3bd93f5f49550f36585d8e

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5U:gh+ZkldoPK8YaKGU

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks