General

  • Target

    bbd155c9a5b490150c78576494493da654bfc7b06d1f1306726d7e7b46b979c9

  • Size

    951KB

  • Sample

    240707-dbxzhssalk

  • MD5

    caef974a06ba64acb821f6e462d13eab

  • SHA1

    ca64ed453de234191d759f6159302d5556468ff3

  • SHA256

    bbd155c9a5b490150c78576494493da654bfc7b06d1f1306726d7e7b46b979c9

  • SHA512

    a0df3eb988ab1cc4fe29a5f60f109bf216b7db9ca916fb27cdbf3aa034388ac3ad651ea11460d8b51c816265406cf46051e76b26a84a90bea7a0d0d8fbade0d5

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5A:Rh+ZkldDPK8YaKjA

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bbd155c9a5b490150c78576494493da654bfc7b06d1f1306726d7e7b46b979c9

    • Size

      951KB

    • MD5

      caef974a06ba64acb821f6e462d13eab

    • SHA1

      ca64ed453de234191d759f6159302d5556468ff3

    • SHA256

      bbd155c9a5b490150c78576494493da654bfc7b06d1f1306726d7e7b46b979c9

    • SHA512

      a0df3eb988ab1cc4fe29a5f60f109bf216b7db9ca916fb27cdbf3aa034388ac3ad651ea11460d8b51c816265406cf46051e76b26a84a90bea7a0d0d8fbade0d5

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5A:Rh+ZkldDPK8YaKjA

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks