General

  • Target

    30ef26ccdc9ea6dde197b4e0fdb9b600N

  • Size

    952KB

  • Sample

    240911-hdr89sxgrc

  • MD5

    30ef26ccdc9ea6dde197b4e0fdb9b600

  • SHA1

    294d39eb43b1a055ce806a7af7b0eac5257d8a3e

  • SHA256

    efcc95e40df3f0a97626f651797398a9699cd05d56be423e85432dff6fb46f95

  • SHA512

    6f943acbcca733ac89b53e081c074c52c5ddbc8162077f623f6b784efe0e03ec7fe344b4fa97ddecd86e070ba71c032b1b030c8e7ea44b9416a0aad6a33bbffb

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5d:Rh+ZkldDPK8YaKjd

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      30ef26ccdc9ea6dde197b4e0fdb9b600N

    • Size

      952KB

    • MD5

      30ef26ccdc9ea6dde197b4e0fdb9b600

    • SHA1

      294d39eb43b1a055ce806a7af7b0eac5257d8a3e

    • SHA256

      efcc95e40df3f0a97626f651797398a9699cd05d56be423e85432dff6fb46f95

    • SHA512

      6f943acbcca733ac89b53e081c074c52c5ddbc8162077f623f6b784efe0e03ec7fe344b4fa97ddecd86e070ba71c032b1b030c8e7ea44b9416a0aad6a33bbffb

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5d:Rh+ZkldDPK8YaKjd

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks