General

  • Target

    e8d024607821d61e0f77c9adba5b0ea0N

  • Size

    952KB

  • Sample

    240911-kd71ts1cpp

  • MD5

    e8d024607821d61e0f77c9adba5b0ea0

  • SHA1

    bb128478d49c79b9216e4ac7331a3b476a00bf6e

  • SHA256

    23160db90b1225aa41a12b7d740f06fda942d273a3db856f00bd021d54f88cd7

  • SHA512

    f31727d3159ab132f4f812369221fce797db49445838af77de9eca04746052016a115488c76c072191f1d44391d78d51bc40a74ba0a147db9abdb3579f9c5c84

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT58:Rh+ZkldDPK8YaKj8

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e8d024607821d61e0f77c9adba5b0ea0N

    • Size

      952KB

    • MD5

      e8d024607821d61e0f77c9adba5b0ea0

    • SHA1

      bb128478d49c79b9216e4ac7331a3b476a00bf6e

    • SHA256

      23160db90b1225aa41a12b7d740f06fda942d273a3db856f00bd021d54f88cd7

    • SHA512

      f31727d3159ab132f4f812369221fce797db49445838af77de9eca04746052016a115488c76c072191f1d44391d78d51bc40a74ba0a147db9abdb3579f9c5c84

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT58:Rh+ZkldDPK8YaKj8

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks