General

  • Target

    064e22c65b14228bd494eec3b015a53fd9989f05221a078d02b9c5180c781683

  • Size

    952KB

  • Sample

    240924-wynngaxfkm

  • MD5

    839f220f72be6308afa1bb691f5ed004

  • SHA1

    62a7304ff2965345ab109b29cf1dc1ae47200046

  • SHA256

    064e22c65b14228bd494eec3b015a53fd9989f05221a078d02b9c5180c781683

  • SHA512

    a1d75790f71dda8ee3ef7d666a5539013aa7f1ca767278c88e2679ea60b0c8edd745d5069654e9256c3b6bc3a7c698cd47737ce18e9fbfd4293b32202b8ec772

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      064e22c65b14228bd494eec3b015a53fd9989f05221a078d02b9c5180c781683

    • Size

      952KB

    • MD5

      839f220f72be6308afa1bb691f5ed004

    • SHA1

      62a7304ff2965345ab109b29cf1dc1ae47200046

    • SHA256

      064e22c65b14228bd494eec3b015a53fd9989f05221a078d02b9c5180c781683

    • SHA512

      a1d75790f71dda8ee3ef7d666a5539013aa7f1ca767278c88e2679ea60b0c8edd745d5069654e9256c3b6bc3a7c698cd47737ce18e9fbfd4293b32202b8ec772

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks