General

  • Target

    927fae8962e8daab312ee92e4f8bdaf3b81c74c0722ad919269ae53732812b54

  • Size

    951KB

  • Sample

    240707-a62dms1drf

  • MD5

    56b43e00e0437f8960b07e717efb6148

  • SHA1

    305bea7a24155d5e3ffad97249c6ce781750d92b

  • SHA256

    927fae8962e8daab312ee92e4f8bdaf3b81c74c0722ad919269ae53732812b54

  • SHA512

    974b82f8d15f18cb1affd582f74003543b7ec1bb15398974d128e35da79c3c7b3abb33b4e528e420130828cf4e41cb49f600b5321e3d32327a9642bd56403841

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5HY:Rh+ZkldDPK8YaKjHY

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      927fae8962e8daab312ee92e4f8bdaf3b81c74c0722ad919269ae53732812b54

    • Size

      951KB

    • MD5

      56b43e00e0437f8960b07e717efb6148

    • SHA1

      305bea7a24155d5e3ffad97249c6ce781750d92b

    • SHA256

      927fae8962e8daab312ee92e4f8bdaf3b81c74c0722ad919269ae53732812b54

    • SHA512

      974b82f8d15f18cb1affd582f74003543b7ec1bb15398974d128e35da79c3c7b3abb33b4e528e420130828cf4e41cb49f600b5321e3d32327a9642bd56403841

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5HY:Rh+ZkldDPK8YaKjHY

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks