General

  • Target

    b122994d1a614078ade4678fadcb0382afa8adbf0657342b9c037b370ec4d071

  • Size

    952KB

  • Sample

    241123-c41ensslej

  • MD5

    a66a72ebd39a274ae92faa7d7a40c6f2

  • SHA1

    01c2b03148790fb3cc3386bb4aa8ebc92619f0b0

  • SHA256

    b122994d1a614078ade4678fadcb0382afa8adbf0657342b9c037b370ec4d071

  • SHA512

    5abbbd79e4a4775313ef7eced0c40c6eaea592bbaac1b946f4fff47be1c954505d387b326925767c8d1592e3749bb83197cb43db083f8f346d26ae1874994908

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b122994d1a614078ade4678fadcb0382afa8adbf0657342b9c037b370ec4d071

    • Size

      952KB

    • MD5

      a66a72ebd39a274ae92faa7d7a40c6f2

    • SHA1

      01c2b03148790fb3cc3386bb4aa8ebc92619f0b0

    • SHA256

      b122994d1a614078ade4678fadcb0382afa8adbf0657342b9c037b370ec4d071

    • SHA512

      5abbbd79e4a4775313ef7eced0c40c6eaea592bbaac1b946f4fff47be1c954505d387b326925767c8d1592e3749bb83197cb43db083f8f346d26ae1874994908

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks