General

  • Target

    f7649892fecc3e8d4452bad3c46d702c62d13a83fc21fec3802d66eeace16a03

  • Size

    905KB

  • Sample

    241202-ez63rszkbt

  • MD5

    a4a6a7e25ff4e3c0c73c77af611792ae

  • SHA1

    a8278e483200995abccb389051bff45d10c36769

  • SHA256

    f7649892fecc3e8d4452bad3c46d702c62d13a83fc21fec3802d66eeace16a03

  • SHA512

    9106dbd8c3ee4aa38a606bdcee99892edd6fecacec9303b48b0715e51b0021127e33743e912d3e14ed304f4705f2eaa56c4b0ef6efb45a756c892a563825c4a1

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5x:gh+ZkldoPK8YaKGx

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f7649892fecc3e8d4452bad3c46d702c62d13a83fc21fec3802d66eeace16a03

    • Size

      905KB

    • MD5

      a4a6a7e25ff4e3c0c73c77af611792ae

    • SHA1

      a8278e483200995abccb389051bff45d10c36769

    • SHA256

      f7649892fecc3e8d4452bad3c46d702c62d13a83fc21fec3802d66eeace16a03

    • SHA512

      9106dbd8c3ee4aa38a606bdcee99892edd6fecacec9303b48b0715e51b0021127e33743e912d3e14ed304f4705f2eaa56c4b0ef6efb45a756c892a563825c4a1

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5x:gh+ZkldoPK8YaKGx

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks