General

  • Target

    00682d210dea4a5805e7af00d45a7d242a29065ab8495389548d1a1e9d0d1ac5

  • Size

    905KB

  • Sample

    241227-xvkyvaxrex

  • MD5

    d921cb7a7f1f0e5947adec26c434e326

  • SHA1

    009040c2d837c87ef49fcff0c6419fde280e4d9e

  • SHA256

    00682d210dea4a5805e7af00d45a7d242a29065ab8495389548d1a1e9d0d1ac5

  • SHA512

    01bfc39483d7b285f7fdc16177df1a31ba56104157e405106a99c44601c9d5237d6b78d3ecf3af1b91c9af623c498df5dd1cdaee1839d5e6114f3fafeb8e60f2

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5b:gh+ZkldoPK8YaKGb

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      00682d210dea4a5805e7af00d45a7d242a29065ab8495389548d1a1e9d0d1ac5

    • Size

      905KB

    • MD5

      d921cb7a7f1f0e5947adec26c434e326

    • SHA1

      009040c2d837c87ef49fcff0c6419fde280e4d9e

    • SHA256

      00682d210dea4a5805e7af00d45a7d242a29065ab8495389548d1a1e9d0d1ac5

    • SHA512

      01bfc39483d7b285f7fdc16177df1a31ba56104157e405106a99c44601c9d5237d6b78d3ecf3af1b91c9af623c498df5dd1cdaee1839d5e6114f3fafeb8e60f2

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5b:gh+ZkldoPK8YaKGb

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks