General

  • Target

    55f05c0a4f5d2135f305572908d2f1b0d5f2342171376150d8598b4dce748442

  • Size

    904KB

  • Sample

    241124-2rbcfstphv

  • MD5

    f3be477d5a0621e00bca8d8ef2610169

  • SHA1

    59c35bd582e821577bff68f75dc50b4b2d5882ed

  • SHA256

    55f05c0a4f5d2135f305572908d2f1b0d5f2342171376150d8598b4dce748442

  • SHA512

    1e0d269c9d48ce30e780ae821b1ad1854e4143e8e9166f2ca1422737efc51123e9cd8d0ae2ba2a5517cb95e4dff8d343fae2ec45bb5af5aa74bfc1460b1b6640

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      55f05c0a4f5d2135f305572908d2f1b0d5f2342171376150d8598b4dce748442

    • Size

      904KB

    • MD5

      f3be477d5a0621e00bca8d8ef2610169

    • SHA1

      59c35bd582e821577bff68f75dc50b4b2d5882ed

    • SHA256

      55f05c0a4f5d2135f305572908d2f1b0d5f2342171376150d8598b4dce748442

    • SHA512

      1e0d269c9d48ce30e780ae821b1ad1854e4143e8e9166f2ca1422737efc51123e9cd8d0ae2ba2a5517cb95e4dff8d343fae2ec45bb5af5aa74bfc1460b1b6640

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa57:gh+ZkldoPK8YaKG7

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks