General

  • Target

    0567606c63907c89f42e69ab6496d240N

  • Size

    952KB

  • Sample

    240911-tlbf9szgje

  • MD5

    0567606c63907c89f42e69ab6496d240

  • SHA1

    40fe6d1a81ee669d9e304faf4342ecc5c3465afb

  • SHA256

    952ae6090a2e07c6da820ff845e38de0529a424f76d97d839f47c5c26e67324f

  • SHA512

    0a3e0de0f0aa64ddf3489756d066ee86a2e9f604a28aecb2eb33bf9ead1cba84f810975c7dcca375417690a4253d8fae809fcb4357cce2e369fe2af32f193d6a

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5D:Rh+ZkldDPK8YaKjD

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      0567606c63907c89f42e69ab6496d240N

    • Size

      952KB

    • MD5

      0567606c63907c89f42e69ab6496d240

    • SHA1

      40fe6d1a81ee669d9e304faf4342ecc5c3465afb

    • SHA256

      952ae6090a2e07c6da820ff845e38de0529a424f76d97d839f47c5c26e67324f

    • SHA512

      0a3e0de0f0aa64ddf3489756d066ee86a2e9f604a28aecb2eb33bf9ead1cba84f810975c7dcca375417690a4253d8fae809fcb4357cce2e369fe2af32f193d6a

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5D:Rh+ZkldDPK8YaKjD

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks