General

  • Target

    cae7a3b70ef31f5c9cc681d8ec9f3a1efa0c196bba0ebc68156a29356a6d05aa

  • Size

    904KB

  • Sample

    241202-c3kmtsvndv

  • MD5

    4a62374897cfdb2adfb6722e6b775521

  • SHA1

    b3c2cb679676ac2e86b878ecc58da86c332f47ed

  • SHA256

    cae7a3b70ef31f5c9cc681d8ec9f3a1efa0c196bba0ebc68156a29356a6d05aa

  • SHA512

    67e2ade9d3fad325e1336a8f52555f386af2f4803eae7eb4884c72df360bb58a438e748a5de1f83111a79fb7f5c26cd75f217ebdbf9084ce81c0f0ceea4f3001

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      cae7a3b70ef31f5c9cc681d8ec9f3a1efa0c196bba0ebc68156a29356a6d05aa

    • Size

      904KB

    • MD5

      4a62374897cfdb2adfb6722e6b775521

    • SHA1

      b3c2cb679676ac2e86b878ecc58da86c332f47ed

    • SHA256

      cae7a3b70ef31f5c9cc681d8ec9f3a1efa0c196bba0ebc68156a29356a6d05aa

    • SHA512

      67e2ade9d3fad325e1336a8f52555f386af2f4803eae7eb4884c72df360bb58a438e748a5de1f83111a79fb7f5c26cd75f217ebdbf9084ce81c0f0ceea4f3001

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5W:gh+ZkldoPK8YaKGW

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks