General

  • Target

    9cd37db9467f1c839a85705d503255dc910305e6a193e0faf8b7c3db9c195556

  • Size

    905KB

  • Sample

    250115-fxndbatphq

  • MD5

    5c69d4f90c2b971324cee922221d1454

  • SHA1

    5568376929031b0a4a2fd3c868f67377587de625

  • SHA256

    9cd37db9467f1c839a85705d503255dc910305e6a193e0faf8b7c3db9c195556

  • SHA512

    952e1cbc8bf8d80dd09a74ba9296140da7823c11ce81aac22b668a48abe6daffe3274d836caa12a8a10a9eefa4bb43cf5fa0bff72a93625a235c95ce40bfefca

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5y:gh+ZkldoPK8YaKGy

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9cd37db9467f1c839a85705d503255dc910305e6a193e0faf8b7c3db9c195556

    • Size

      905KB

    • MD5

      5c69d4f90c2b971324cee922221d1454

    • SHA1

      5568376929031b0a4a2fd3c868f67377587de625

    • SHA256

      9cd37db9467f1c839a85705d503255dc910305e6a193e0faf8b7c3db9c195556

    • SHA512

      952e1cbc8bf8d80dd09a74ba9296140da7823c11ce81aac22b668a48abe6daffe3274d836caa12a8a10a9eefa4bb43cf5fa0bff72a93625a235c95ce40bfefca

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5y:gh+ZkldoPK8YaKGy

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks