General

  • Target

    3e58ae662b77bbd844c4a0258a5d9392dd88acd0f177f3b87cb5d4c96870e561N

  • Size

    952KB

  • Sample

    240930-mngbzavdpf

  • MD5

    dbe65f481384836f6559985f7a21df70

  • SHA1

    739261cef6f4097d9cfe7e6dcffb9a8666e0bb7b

  • SHA256

    3e58ae662b77bbd844c4a0258a5d9392dd88acd0f177f3b87cb5d4c96870e561

  • SHA512

    3129603838d783e4aaaacfc240986552bb26c6b89fc65107be99e497afcb8907ed30c0f113736807e82561902e89cd752332fcc51f76e6fb8332c3192ad8c6df

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5y:Rh+ZkldDPK8YaKjy

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3e58ae662b77bbd844c4a0258a5d9392dd88acd0f177f3b87cb5d4c96870e561N

    • Size

      952KB

    • MD5

      dbe65f481384836f6559985f7a21df70

    • SHA1

      739261cef6f4097d9cfe7e6dcffb9a8666e0bb7b

    • SHA256

      3e58ae662b77bbd844c4a0258a5d9392dd88acd0f177f3b87cb5d4c96870e561

    • SHA512

      3129603838d783e4aaaacfc240986552bb26c6b89fc65107be99e497afcb8907ed30c0f113736807e82561902e89cd752332fcc51f76e6fb8332c3192ad8c6df

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5y:Rh+ZkldDPK8YaKjy

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks