General

  • Target

    796beb97a379f793feef05d7c03223769f1fa03a019c382b9e6dc3fd8f955d53

  • Size

    904KB

  • Sample

    241209-2pstqatqfy

  • MD5

    773c4d69a9937528525612ebdff0cffb

  • SHA1

    3130faed534f66d69ffbc6b01b32821a0975d8d2

  • SHA256

    796beb97a379f793feef05d7c03223769f1fa03a019c382b9e6dc3fd8f955d53

  • SHA512

    1506930ce585d1e7d08daee7ec6e47ff8c8917d9a6a7e2e237f548233167641c68e26b32555f0665060c41ee43ce64ced0cf53c7eef92c6345eb910004bdd841

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      796beb97a379f793feef05d7c03223769f1fa03a019c382b9e6dc3fd8f955d53

    • Size

      904KB

    • MD5

      773c4d69a9937528525612ebdff0cffb

    • SHA1

      3130faed534f66d69ffbc6b01b32821a0975d8d2

    • SHA256

      796beb97a379f793feef05d7c03223769f1fa03a019c382b9e6dc3fd8f955d53

    • SHA512

      1506930ce585d1e7d08daee7ec6e47ff8c8917d9a6a7e2e237f548233167641c68e26b32555f0665060c41ee43ce64ced0cf53c7eef92c6345eb910004bdd841

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks