General

  • Target

    b92eb9909c68c8f0f9a99c337e70d71aefcae8e6a9e0525eb623a53091e637e6

  • Size

    905KB

  • Sample

    250306-lysmbavygy

  • MD5

    14c8b985dddb3c9106f21294bf7fd27b

  • SHA1

    9fe0a0f2a46a1d360de4abf6eb07872d644ebd21

  • SHA256

    b92eb9909c68c8f0f9a99c337e70d71aefcae8e6a9e0525eb623a53091e637e6

  • SHA512

    c41a289fbafef02e89329591b94418db29b01b762ce4826f00a64ad5cf71d6457699bc2651fc868c3efef18d2c5db04891458ec2f467c5ccce43eb60a2667489

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b92eb9909c68c8f0f9a99c337e70d71aefcae8e6a9e0525eb623a53091e637e6

    • Size

      905KB

    • MD5

      14c8b985dddb3c9106f21294bf7fd27b

    • SHA1

      9fe0a0f2a46a1d360de4abf6eb07872d644ebd21

    • SHA256

      b92eb9909c68c8f0f9a99c337e70d71aefcae8e6a9e0525eb623a53091e637e6

    • SHA512

      c41a289fbafef02e89329591b94418db29b01b762ce4826f00a64ad5cf71d6457699bc2651fc868c3efef18d2c5db04891458ec2f467c5ccce43eb60a2667489

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks