General

  • Target

    3c6820b84a9bd5ded46ba2784808b430N

  • Size

    952KB

  • Sample

    240911-rg2fsavelc

  • MD5

    3c6820b84a9bd5ded46ba2784808b430

  • SHA1

    ed78435cd9141385cb2dfe76d839a1f5882f665a

  • SHA256

    e27dec6b09aab87c36a03ee0cd76313731a4d5299c086f32758d6d115ac2062a

  • SHA512

    024d7ede3634a7698796712e9a5b3e6a93b9ea965db290f96b726a37f941bf17284505985b04dcc78f65d0651e1fc2ba87a61d04449b5f2790a6e43435850f30

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3c6820b84a9bd5ded46ba2784808b430N

    • Size

      952KB

    • MD5

      3c6820b84a9bd5ded46ba2784808b430

    • SHA1

      ed78435cd9141385cb2dfe76d839a1f5882f665a

    • SHA256

      e27dec6b09aab87c36a03ee0cd76313731a4d5299c086f32758d6d115ac2062a

    • SHA512

      024d7ede3634a7698796712e9a5b3e6a93b9ea965db290f96b726a37f941bf17284505985b04dcc78f65d0651e1fc2ba87a61d04449b5f2790a6e43435850f30

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks