General

  • Target

    901ab6654a0e34bd4f214e3def832e4ff3ffa0dd32467f8ed05599a0a3525bc6

  • Size

    905KB

  • Sample

    250314-gb8b2awrx4

  • MD5

    7d58fe79822d670ced4a237b10fda584

  • SHA1

    c54e980fe06b32ea20cb2a7dd45164d9ec4dddf3

  • SHA256

    901ab6654a0e34bd4f214e3def832e4ff3ffa0dd32467f8ed05599a0a3525bc6

  • SHA512

    80efac5168104047f2b7a478e2bd9502cf37e1510c245e6fe8bec20dd4ffb4162ff5db8d440a05a8d910bd4b4b1274fd07ea1d782ef78ab1ef1c72195ed624ad

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      901ab6654a0e34bd4f214e3def832e4ff3ffa0dd32467f8ed05599a0a3525bc6

    • Size

      905KB

    • MD5

      7d58fe79822d670ced4a237b10fda584

    • SHA1

      c54e980fe06b32ea20cb2a7dd45164d9ec4dddf3

    • SHA256

      901ab6654a0e34bd4f214e3def832e4ff3ffa0dd32467f8ed05599a0a3525bc6

    • SHA512

      80efac5168104047f2b7a478e2bd9502cf37e1510c245e6fe8bec20dd4ffb4162ff5db8d440a05a8d910bd4b4b1274fd07ea1d782ef78ab1ef1c72195ed624ad

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5M:gh+ZkldoPK8YaKGM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks