General

  • Target

    45063b65734f5d525ec08a07dac97756c7d032fcacdbbd8fbfd01037f07a6d3b

  • Size

    951KB

  • Sample

    240518-zqz83sfb3v

  • MD5

    0a75d2ea61e93de87fddedd157032669

  • SHA1

    f09a850d3a0ad0e0c589a89967b63f5374f280d1

  • SHA256

    45063b65734f5d525ec08a07dac97756c7d032fcacdbbd8fbfd01037f07a6d3b

  • SHA512

    05039e351a0077083028cc104f95a1f161307e95132040696aef0a80921cbffbf031761929c7a8b096e61e525f007ab31774411bb051ea2ae544feb7a4a9ec88

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5j:Rh+ZkldDPK8YaKjj

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      45063b65734f5d525ec08a07dac97756c7d032fcacdbbd8fbfd01037f07a6d3b

    • Size

      951KB

    • MD5

      0a75d2ea61e93de87fddedd157032669

    • SHA1

      f09a850d3a0ad0e0c589a89967b63f5374f280d1

    • SHA256

      45063b65734f5d525ec08a07dac97756c7d032fcacdbbd8fbfd01037f07a6d3b

    • SHA512

      05039e351a0077083028cc104f95a1f161307e95132040696aef0a80921cbffbf031761929c7a8b096e61e525f007ab31774411bb051ea2ae544feb7a4a9ec88

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5j:Rh+ZkldDPK8YaKjj

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks