General

  • Target

    f3451c396f00621b04054d14c7f3afb2bcb05a939ba0f9dddee98c410dc95caf

  • Size

    902KB

  • Sample

    250306-r4ewas1qs3

  • MD5

    17d048d7f6fc33a6f97247fc90607f8b

  • SHA1

    0978b382c8e908697686c107ed69bcfd12c88611

  • SHA256

    f3451c396f00621b04054d14c7f3afb2bcb05a939ba0f9dddee98c410dc95caf

  • SHA512

    418c5d1ba49ad3a5538174cf480938329029d0b0892b14abe77b4fff1424ed7bf077faddd8e72a4a273150590c65de586606f856ea62dcfc5ba6b064c8bb226d

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f3451c396f00621b04054d14c7f3afb2bcb05a939ba0f9dddee98c410dc95caf

    • Size

      902KB

    • MD5

      17d048d7f6fc33a6f97247fc90607f8b

    • SHA1

      0978b382c8e908697686c107ed69bcfd12c88611

    • SHA256

      f3451c396f00621b04054d14c7f3afb2bcb05a939ba0f9dddee98c410dc95caf

    • SHA512

      418c5d1ba49ad3a5538174cf480938329029d0b0892b14abe77b4fff1424ed7bf077faddd8e72a4a273150590c65de586606f856ea62dcfc5ba6b064c8bb226d

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5F:gh+ZkldoPK8YaKGF

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks