General

  • Target

    9343ed3d1ccbe2cb8e050cf3306f6319d2712aad533b4f4ae24bec16f339ba57

  • Size

    951KB

  • Sample

    240704-bdfrxaxdqf

  • MD5

    e0c0b5c3b19325e8f63e5febe6cb57f8

  • SHA1

    2da3750bcc13197a69679ade7390b792a5e52a18

  • SHA256

    9343ed3d1ccbe2cb8e050cf3306f6319d2712aad533b4f4ae24bec16f339ba57

  • SHA512

    a6697d3d844dc99704339ddf960e9f746d820ab5e6dbc501921633c5f960c6d9b863d7f3b103fb59d65a5949e483f6f990cd405cc17580e9367acea5dfba3479

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5n:Rh+ZkldDPK8YaKjn

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9343ed3d1ccbe2cb8e050cf3306f6319d2712aad533b4f4ae24bec16f339ba57

    • Size

      951KB

    • MD5

      e0c0b5c3b19325e8f63e5febe6cb57f8

    • SHA1

      2da3750bcc13197a69679ade7390b792a5e52a18

    • SHA256

      9343ed3d1ccbe2cb8e050cf3306f6319d2712aad533b4f4ae24bec16f339ba57

    • SHA512

      a6697d3d844dc99704339ddf960e9f746d820ab5e6dbc501921633c5f960c6d9b863d7f3b103fb59d65a5949e483f6f990cd405cc17580e9367acea5dfba3479

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5n:Rh+ZkldDPK8YaKjn

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks