General

  • Target

    1d75b3738984da428bdc22cf39d49a288285b22d67b3e433de15685ada4143f4N

  • Size

    904KB

  • Sample

    241110-nw32dawfqc

  • MD5

    8a77d7648d7f8773b657fc8fe9f5c9a0

  • SHA1

    69e377603772a6422f27431b4d175a6f1456f63a

  • SHA256

    1d75b3738984da428bdc22cf39d49a288285b22d67b3e433de15685ada4143f4

  • SHA512

    db512907cb4bc7733935290b5c479860beaa7adcac4ad7e36d80434ab2821af03950943282734992be7b6aeb4689fcf646e64d230d11834a0a5b566e2c56ad3f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1d75b3738984da428bdc22cf39d49a288285b22d67b3e433de15685ada4143f4N

    • Size

      904KB

    • MD5

      8a77d7648d7f8773b657fc8fe9f5c9a0

    • SHA1

      69e377603772a6422f27431b4d175a6f1456f63a

    • SHA256

      1d75b3738984da428bdc22cf39d49a288285b22d67b3e433de15685ada4143f4

    • SHA512

      db512907cb4bc7733935290b5c479860beaa7adcac4ad7e36d80434ab2821af03950943282734992be7b6aeb4689fcf646e64d230d11834a0a5b566e2c56ad3f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa50:gh+ZkldoPK8YaKG0

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks