General

  • Target

    a5eb12a7cebea9ba18de79d14df8a05d9139d146661820a18feb06c1f5718715

  • Size

    905KB

  • Sample

    250110-gh2g3atqg1

  • MD5

    49341ff59199c7e6b1a3a042f26a4ba0

  • SHA1

    56db3a99b1e68fe59795e119f78060aa3752ec61

  • SHA256

    a5eb12a7cebea9ba18de79d14df8a05d9139d146661820a18feb06c1f5718715

  • SHA512

    ccb8d7fd97f748c5f958e7182214fd7ddbc3a1fcd75b2be7a37c4d76644a098538e2b366c25491b67fdaf3ecb4c5c987ae20ce1fc36f3753292fd3cee9f36405

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5t:gh+ZkldoPK8YaKGt

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a5eb12a7cebea9ba18de79d14df8a05d9139d146661820a18feb06c1f5718715

    • Size

      905KB

    • MD5

      49341ff59199c7e6b1a3a042f26a4ba0

    • SHA1

      56db3a99b1e68fe59795e119f78060aa3752ec61

    • SHA256

      a5eb12a7cebea9ba18de79d14df8a05d9139d146661820a18feb06c1f5718715

    • SHA512

      ccb8d7fd97f748c5f958e7182214fd7ddbc3a1fcd75b2be7a37c4d76644a098538e2b366c25491b67fdaf3ecb4c5c987ae20ce1fc36f3753292fd3cee9f36405

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5t:gh+ZkldoPK8YaKGt

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks