General

  • Target

    b1f539788e7505f0eacd73b93844a530N

  • Size

    952KB

  • Sample

    240914-wkxdfsxfmc

  • MD5

    b1f539788e7505f0eacd73b93844a530

  • SHA1

    7ca4fa8fce54ad2fe1919df257d68cd6682f4b9a

  • SHA256

    1358e960846f08bafd42001f45ea60651aeab047fbfd404048f1f171e64e9021

  • SHA512

    f5f3ad8fbb5dbbe1abf1126fd856cf1e80465591d3893b33365c99dc6db01a8886b3cde16a8dc9c6ef34c1ac4e3d2f721653b803d7ac640bd630242d0cdc28e9

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5X:Rh+ZkldDPK8YaKjX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b1f539788e7505f0eacd73b93844a530N

    • Size

      952KB

    • MD5

      b1f539788e7505f0eacd73b93844a530

    • SHA1

      7ca4fa8fce54ad2fe1919df257d68cd6682f4b9a

    • SHA256

      1358e960846f08bafd42001f45ea60651aeab047fbfd404048f1f171e64e9021

    • SHA512

      f5f3ad8fbb5dbbe1abf1126fd856cf1e80465591d3893b33365c99dc6db01a8886b3cde16a8dc9c6ef34c1ac4e3d2f721653b803d7ac640bd630242d0cdc28e9

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5X:Rh+ZkldDPK8YaKjX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks