General

  • Target

    6284949c15520ff340481118fef175f3b32e61e17bcb7241ae4fa342d593eedd

  • Size

    904KB

  • Sample

    241201-2j8b8avqet

  • MD5

    5f72638a7a65b1b4b80f72f6b40fb3fd

  • SHA1

    1ff6ea5cc4537890f6fcf6b48895c197e04e1538

  • SHA256

    6284949c15520ff340481118fef175f3b32e61e17bcb7241ae4fa342d593eedd

  • SHA512

    615d64310bde4a7623b769ba3c40d27bd1cadd4c4a00e3565abf7338162f85b0a7948a994b64501925224b58dbad75f667bdf0497a7ba3c238c63dccf03af66a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6284949c15520ff340481118fef175f3b32e61e17bcb7241ae4fa342d593eedd

    • Size

      904KB

    • MD5

      5f72638a7a65b1b4b80f72f6b40fb3fd

    • SHA1

      1ff6ea5cc4537890f6fcf6b48895c197e04e1538

    • SHA256

      6284949c15520ff340481118fef175f3b32e61e17bcb7241ae4fa342d593eedd

    • SHA512

      615d64310bde4a7623b769ba3c40d27bd1cadd4c4a00e3565abf7338162f85b0a7948a994b64501925224b58dbad75f667bdf0497a7ba3c238c63dccf03af66a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5O:gh+ZkldoPK8YaKGO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks