General

  • Target

    26336a83be10ad25ad8ed9830ff4f551419bd7ee42ae1c797b39875f435ef640

  • Size

    952KB

  • Sample

    240917-x75h1s1bna

  • MD5

    1ae77d19af7f36f75f77d0b2a04aa43f

  • SHA1

    926d341d68095d89c4a315a3c78a6d8e3b6a09bb

  • SHA256

    26336a83be10ad25ad8ed9830ff4f551419bd7ee42ae1c797b39875f435ef640

  • SHA512

    c511b7761a97f641bd6872dab79a30b7ed2f4d1e58aee05c92cacdbd7102318b624554107a9071eb544991d7722841a7d46df1555c7a4dfdfe6cd85db8f92774

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      26336a83be10ad25ad8ed9830ff4f551419bd7ee42ae1c797b39875f435ef640

    • Size

      952KB

    • MD5

      1ae77d19af7f36f75f77d0b2a04aa43f

    • SHA1

      926d341d68095d89c4a315a3c78a6d8e3b6a09bb

    • SHA256

      26336a83be10ad25ad8ed9830ff4f551419bd7ee42ae1c797b39875f435ef640

    • SHA512

      c511b7761a97f641bd6872dab79a30b7ed2f4d1e58aee05c92cacdbd7102318b624554107a9071eb544991d7722841a7d46df1555c7a4dfdfe6cd85db8f92774

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks