General

  • Target

    792927b61266cc91b84043c753ad2795082789e77c7934f36845fdc74570b03d

  • Size

    905KB

  • Sample

    241218-2va6vsvqhw

  • MD5

    969ef80f24f5ddeac43f0e1610322f2d

  • SHA1

    5228620f24c24debb95a9cc14f70cde84777c4c6

  • SHA256

    792927b61266cc91b84043c753ad2795082789e77c7934f36845fdc74570b03d

  • SHA512

    731d2517ce7d5b6289bce76293619da9c3fa225611ac676276224cbeb373fd2190daa98c365189c4c6ed4b6368ab84401dfe06e5eafbe63ef3cc036643e031c6

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      792927b61266cc91b84043c753ad2795082789e77c7934f36845fdc74570b03d

    • Size

      905KB

    • MD5

      969ef80f24f5ddeac43f0e1610322f2d

    • SHA1

      5228620f24c24debb95a9cc14f70cde84777c4c6

    • SHA256

      792927b61266cc91b84043c753ad2795082789e77c7934f36845fdc74570b03d

    • SHA512

      731d2517ce7d5b6289bce76293619da9c3fa225611ac676276224cbeb373fd2190daa98c365189c4c6ed4b6368ab84401dfe06e5eafbe63ef3cc036643e031c6

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5N:gh+ZkldoPK8YaKGN

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks