General

  • Target

    e3425e033f2efd4cfdc5312e048409420b6ab41a714466b263e3f5557aceca14

  • Size

    902KB

  • Sample

    250306-qqfd8sznw9

  • MD5

    1aa7d4222a3f46aba503e45a6ed0f085

  • SHA1

    31e4d1371bcefcafa7598c2378595f99e4155391

  • SHA256

    e3425e033f2efd4cfdc5312e048409420b6ab41a714466b263e3f5557aceca14

  • SHA512

    b4698cabdff7c74c25e24906975e2456d007bbe54b575c3b798b127376c92e3aa2dd0e45d50276701ebe7f6c41d59798afe0cb87502075903b8fe8941339cfd6

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e3425e033f2efd4cfdc5312e048409420b6ab41a714466b263e3f5557aceca14

    • Size

      902KB

    • MD5

      1aa7d4222a3f46aba503e45a6ed0f085

    • SHA1

      31e4d1371bcefcafa7598c2378595f99e4155391

    • SHA256

      e3425e033f2efd4cfdc5312e048409420b6ab41a714466b263e3f5557aceca14

    • SHA512

      b4698cabdff7c74c25e24906975e2456d007bbe54b575c3b798b127376c92e3aa2dd0e45d50276701ebe7f6c41d59798afe0cb87502075903b8fe8941339cfd6

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5r:gh+ZkldoPK8YaKGr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks