General

  • Target

    a84166dc70ff3ae5c435e548392e514c05663d2a8ae0762936993715bb3d8ae1

  • Size

    904KB

  • Sample

    241127-c41ensyren

  • MD5

    df54f2ccc4ac99d81676eae9c6eef833

  • SHA1

    2a5c9e68f08d1d40f671f1cf6c0d02c5665a34ab

  • SHA256

    a84166dc70ff3ae5c435e548392e514c05663d2a8ae0762936993715bb3d8ae1

  • SHA512

    b9b9e5d602006445a42df120d880926441f446f3ca57d60fbfab12d2077fe599664cd1ae03b530106cbe1fb58d280e51c73a40acb699f7d98259bf4a255420ed

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a84166dc70ff3ae5c435e548392e514c05663d2a8ae0762936993715bb3d8ae1

    • Size

      904KB

    • MD5

      df54f2ccc4ac99d81676eae9c6eef833

    • SHA1

      2a5c9e68f08d1d40f671f1cf6c0d02c5665a34ab

    • SHA256

      a84166dc70ff3ae5c435e548392e514c05663d2a8ae0762936993715bb3d8ae1

    • SHA512

      b9b9e5d602006445a42df120d880926441f446f3ca57d60fbfab12d2077fe599664cd1ae03b530106cbe1fb58d280e51c73a40acb699f7d98259bf4a255420ed

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks