General

  • Target

    c4e4c659f36aef819028361a3debd3215f3cc997d30ded412a3a5e9bcaf64666

  • Size

    952KB

  • Sample

    241201-dk6b9avmay

  • MD5

    c77c741e59c96aa6eb9ff32bb28f7c13

  • SHA1

    2b51d5c92e7d763033f3d9433c2168f2afeac696

  • SHA256

    c4e4c659f36aef819028361a3debd3215f3cc997d30ded412a3a5e9bcaf64666

  • SHA512

    a88c80ce0899e289648d53e5d9705e2b64866a30820ff0fa57ab54c5c92e65259e95774cb7f82a158e5431962446d6037a6ae59770e23bb20ed259362461846d

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5e:Rh+ZkldDPK8YaKje

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c4e4c659f36aef819028361a3debd3215f3cc997d30ded412a3a5e9bcaf64666

    • Size

      952KB

    • MD5

      c77c741e59c96aa6eb9ff32bb28f7c13

    • SHA1

      2b51d5c92e7d763033f3d9433c2168f2afeac696

    • SHA256

      c4e4c659f36aef819028361a3debd3215f3cc997d30ded412a3a5e9bcaf64666

    • SHA512

      a88c80ce0899e289648d53e5d9705e2b64866a30820ff0fa57ab54c5c92e65259e95774cb7f82a158e5431962446d6037a6ae59770e23bb20ed259362461846d

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5e:Rh+ZkldDPK8YaKje

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks