General

  • Target

    6f55192e4952ab9c01d9c002c294f9e0N

  • Size

    952KB

  • Sample

    240910-mrkhss1elf

  • MD5

    6f55192e4952ab9c01d9c002c294f9e0

  • SHA1

    828aa47a3cfa59097a45925810f0fac512caad10

  • SHA256

    ff84e3070caf2711c2e44933dc011c4b20eda2a54c58facc51bf512aecc4193a

  • SHA512

    fdce5283c807069c0ebd890c1b49abc26d35cc90195afef794ca55907745d00b6e45123005c46518569efd17221a136823d987bd779ea2945251274196dda858

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6f55192e4952ab9c01d9c002c294f9e0N

    • Size

      952KB

    • MD5

      6f55192e4952ab9c01d9c002c294f9e0

    • SHA1

      828aa47a3cfa59097a45925810f0fac512caad10

    • SHA256

      ff84e3070caf2711c2e44933dc011c4b20eda2a54c58facc51bf512aecc4193a

    • SHA512

      fdce5283c807069c0ebd890c1b49abc26d35cc90195afef794ca55907745d00b6e45123005c46518569efd17221a136823d987bd779ea2945251274196dda858

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks