General

  • Target

    13de2ed0e7e92aef0b90a4357b80072c7fb35a0b207e10570a5d646ec84bc0b4

  • Size

    904KB

  • Sample

    241127-yphf7sxqdy

  • MD5

    74c1a16b6f8c629161671323d18d97ed

  • SHA1

    e1abd177e964ae327b98ed31b615568e55c74d87

  • SHA256

    13de2ed0e7e92aef0b90a4357b80072c7fb35a0b207e10570a5d646ec84bc0b4

  • SHA512

    74ed0b5cf37a8a3563850be0e8c1579b7b1696f7f4cd7fffeb41bda0ddb1ca0dcf2a8e80b52f2c0a02ca4e1195e105f58df376fbb719cf7ce662ce2375dccc28

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      13de2ed0e7e92aef0b90a4357b80072c7fb35a0b207e10570a5d646ec84bc0b4

    • Size

      904KB

    • MD5

      74c1a16b6f8c629161671323d18d97ed

    • SHA1

      e1abd177e964ae327b98ed31b615568e55c74d87

    • SHA256

      13de2ed0e7e92aef0b90a4357b80072c7fb35a0b207e10570a5d646ec84bc0b4

    • SHA512

      74ed0b5cf37a8a3563850be0e8c1579b7b1696f7f4cd7fffeb41bda0ddb1ca0dcf2a8e80b52f2c0a02ca4e1195e105f58df376fbb719cf7ce662ce2375dccc28

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks