General

  • Target

    2f465987ed143ff1cbb046cd41f16a2d4a4bfdbe4d6d22da38ef36dd9e34866a

  • Size

    952KB

  • Sample

    240913-yzgyeswflq

  • MD5

    360ad01ba11788b2dde51c5a8adf0e34

  • SHA1

    126ee2b9254ec76851f45fc483c59db3a805735e

  • SHA256

    2f465987ed143ff1cbb046cd41f16a2d4a4bfdbe4d6d22da38ef36dd9e34866a

  • SHA512

    b874e01bba47fd03e1fac9254ba9175578ec65ea5a5b5701f59ce7c84df33deaeccc4d5b145661335877581f34759fe14a0a667f6dd0072da88d2717f347fbe5

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2f465987ed143ff1cbb046cd41f16a2d4a4bfdbe4d6d22da38ef36dd9e34866a

    • Size

      952KB

    • MD5

      360ad01ba11788b2dde51c5a8adf0e34

    • SHA1

      126ee2b9254ec76851f45fc483c59db3a805735e

    • SHA256

      2f465987ed143ff1cbb046cd41f16a2d4a4bfdbe4d6d22da38ef36dd9e34866a

    • SHA512

      b874e01bba47fd03e1fac9254ba9175578ec65ea5a5b5701f59ce7c84df33deaeccc4d5b145661335877581f34759fe14a0a667f6dd0072da88d2717f347fbe5

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks