General

  • Target

    2184025f5c82da6f5f8caca4ed9c54383c83c78fd175355224ee370095c3a490

  • Size

    951KB

  • Sample

    240804-x8wx9stepp

  • MD5

    f993337eb29c18733cbbae79c075eff5

  • SHA1

    07c52c333505a5a4f13fd2312395527b70775391

  • SHA256

    2184025f5c82da6f5f8caca4ed9c54383c83c78fd175355224ee370095c3a490

  • SHA512

    529849273d05e126761880300de792d0ceceb8525030794e0370aaf3b5ac0168b451423fe836a5b068a3219c04db1c5604f631bda0168004078c556f91e13bc1

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5y:Rh+ZkldDPK8YaKjy

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2184025f5c82da6f5f8caca4ed9c54383c83c78fd175355224ee370095c3a490

    • Size

      951KB

    • MD5

      f993337eb29c18733cbbae79c075eff5

    • SHA1

      07c52c333505a5a4f13fd2312395527b70775391

    • SHA256

      2184025f5c82da6f5f8caca4ed9c54383c83c78fd175355224ee370095c3a490

    • SHA512

      529849273d05e126761880300de792d0ceceb8525030794e0370aaf3b5ac0168b451423fe836a5b068a3219c04db1c5604f631bda0168004078c556f91e13bc1

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5y:Rh+ZkldDPK8YaKjy

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks