General

  • Target

    e83f04ae06f57930c767203b7de86e60892055d20294791dab55d6ef3d70cfcfN

  • Size

    952KB

  • Sample

    241003-e5y94syclf

  • MD5

    cc28bc3d31d1fc6f4227fe9474347030

  • SHA1

    d21c7eb88442adb8d9a7babca4c085ee0414a866

  • SHA256

    e83f04ae06f57930c767203b7de86e60892055d20294791dab55d6ef3d70cfcf

  • SHA512

    0f51d01e05035bc5f9961a5074233fa07821f007613f6fd397f842ce5b6a5a21f039bfbb9dc109d6e17c981adfc42f532fff93d80ce0940c149acd5abfca83f3

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT59:Rh+ZkldDPK8YaKj9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e83f04ae06f57930c767203b7de86e60892055d20294791dab55d6ef3d70cfcfN

    • Size

      952KB

    • MD5

      cc28bc3d31d1fc6f4227fe9474347030

    • SHA1

      d21c7eb88442adb8d9a7babca4c085ee0414a866

    • SHA256

      e83f04ae06f57930c767203b7de86e60892055d20294791dab55d6ef3d70cfcf

    • SHA512

      0f51d01e05035bc5f9961a5074233fa07821f007613f6fd397f842ce5b6a5a21f039bfbb9dc109d6e17c981adfc42f532fff93d80ce0940c149acd5abfca83f3

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT59:Rh+ZkldDPK8YaKj9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks