General

  • Target

    31ff141a6cdb965b8689b30b5170bbcbb4b51c343420480536d6827b2bdc9eb8

  • Size

    905KB

  • Sample

    241231-zwgnxs1qej

  • MD5

    434c880d716823404fcaf8ec3501348e

  • SHA1

    1bb92286928bba15136cc0cf64ddf0a66c376401

  • SHA256

    31ff141a6cdb965b8689b30b5170bbcbb4b51c343420480536d6827b2bdc9eb8

  • SHA512

    e84108d411034b05474a6e62cf741c11f44ca0a16e9e9deadb4cc13657bc7cd826d979e4c654234092ef6a706d8e3c69beebbce4290cc9b2cc5720c36552d0bd

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      31ff141a6cdb965b8689b30b5170bbcbb4b51c343420480536d6827b2bdc9eb8

    • Size

      905KB

    • MD5

      434c880d716823404fcaf8ec3501348e

    • SHA1

      1bb92286928bba15136cc0cf64ddf0a66c376401

    • SHA256

      31ff141a6cdb965b8689b30b5170bbcbb4b51c343420480536d6827b2bdc9eb8

    • SHA512

      e84108d411034b05474a6e62cf741c11f44ca0a16e9e9deadb4cc13657bc7cd826d979e4c654234092ef6a706d8e3c69beebbce4290cc9b2cc5720c36552d0bd

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5G:gh+ZkldoPK8YaKGG

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks