General

  • Target

    a4df6b9cc496f445c81cbec1da7efad83a023b9aa03116920e92b3ee14e7d415

  • Size

    904KB

  • Sample

    241114-bjwqbasenp

  • MD5

    5d3bd0a2a19776dd6a1c270c9a48c198

  • SHA1

    8e4ad792377d364d441ff85c4de6bd52759215ab

  • SHA256

    a4df6b9cc496f445c81cbec1da7efad83a023b9aa03116920e92b3ee14e7d415

  • SHA512

    0f817a14f114885e0e196e23f747b17a94b89cd44ab6775eafef1e9e15abce64736b47d9c5f2dd0f7324613d56565d7ae526f4b0ac976ba45330ca8e15972538

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a4df6b9cc496f445c81cbec1da7efad83a023b9aa03116920e92b3ee14e7d415

    • Size

      904KB

    • MD5

      5d3bd0a2a19776dd6a1c270c9a48c198

    • SHA1

      8e4ad792377d364d441ff85c4de6bd52759215ab

    • SHA256

      a4df6b9cc496f445c81cbec1da7efad83a023b9aa03116920e92b3ee14e7d415

    • SHA512

      0f817a14f114885e0e196e23f747b17a94b89cd44ab6775eafef1e9e15abce64736b47d9c5f2dd0f7324613d56565d7ae526f4b0ac976ba45330ca8e15972538

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks