General

  • Target

    114e0c077ec4f55df270903bc4b69e3b26fc1568cad7ef1053fcc33e50b2243c

  • Size

    951KB

  • Sample

    240513-xd6tzshd9t

  • MD5

    95f0024ceca563f00a226e1fc67a4018

  • SHA1

    6c675c1c7588d96718cf25e70eb6dbfff1a7c155

  • SHA256

    114e0c077ec4f55df270903bc4b69e3b26fc1568cad7ef1053fcc33e50b2243c

  • SHA512

    b58c5909ba7625f2424ff9a770a6690f8b000ccf33185f4f24557bed9dbbc770fd5a565ab9b48338e4f5f645853ceafbdccef25bbbb42aa71c036205cab1bc57

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT56:Rh+ZkldDPK8YaKj6

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      114e0c077ec4f55df270903bc4b69e3b26fc1568cad7ef1053fcc33e50b2243c

    • Size

      951KB

    • MD5

      95f0024ceca563f00a226e1fc67a4018

    • SHA1

      6c675c1c7588d96718cf25e70eb6dbfff1a7c155

    • SHA256

      114e0c077ec4f55df270903bc4b69e3b26fc1568cad7ef1053fcc33e50b2243c

    • SHA512

      b58c5909ba7625f2424ff9a770a6690f8b000ccf33185f4f24557bed9dbbc770fd5a565ab9b48338e4f5f645853ceafbdccef25bbbb42aa71c036205cab1bc57

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT56:Rh+ZkldDPK8YaKj6

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks