General

  • Target

    7e4d626fccc0de1aad75e46440a0ea60N

  • Size

    952KB

  • Sample

    240911-jn7mda1ajc

  • MD5

    7e4d626fccc0de1aad75e46440a0ea60

  • SHA1

    eff2f3cf5d21b580bc203dbda51047c8e4662983

  • SHA256

    de45a3d7cc7480457e420fb2d47db195406ff098d121c583af3c8b3b9505d846

  • SHA512

    f393f366105637d187532871c3342bde40275c1ccccd440e080c138ef0b4e8fc29cb9b449a04db42bd2b64714c2ee47fdd2ae3bd93773e079f44d8290386b498

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5V:Rh+ZkldDPK8YaKjV

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      7e4d626fccc0de1aad75e46440a0ea60N

    • Size

      952KB

    • MD5

      7e4d626fccc0de1aad75e46440a0ea60

    • SHA1

      eff2f3cf5d21b580bc203dbda51047c8e4662983

    • SHA256

      de45a3d7cc7480457e420fb2d47db195406ff098d121c583af3c8b3b9505d846

    • SHA512

      f393f366105637d187532871c3342bde40275c1ccccd440e080c138ef0b4e8fc29cb9b449a04db42bd2b64714c2ee47fdd2ae3bd93773e079f44d8290386b498

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5V:Rh+ZkldDPK8YaKjV

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks