General

  • Target

    3837831ce8b944076c88e4341840d20daa4c84e22fc64ce4c6a6f971e2bda8c5

  • Size

    952KB

  • Sample

    241202-zxhbvaymap

  • MD5

    3b7411b418605c1c63f35e251face868

  • SHA1

    5edcbf7ed96decef702213170e801e9e21820ab7

  • SHA256

    3837831ce8b944076c88e4341840d20daa4c84e22fc64ce4c6a6f971e2bda8c5

  • SHA512

    d62e4863a6164d89341fb8e95bf93ddec58e36201ca2d34457c92ecedde249281e258e8a14ab1efd98fe4d928b3ab7b13a1015ae020c9f1955cc1f9a1a5a8c6b

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3837831ce8b944076c88e4341840d20daa4c84e22fc64ce4c6a6f971e2bda8c5

    • Size

      952KB

    • MD5

      3b7411b418605c1c63f35e251face868

    • SHA1

      5edcbf7ed96decef702213170e801e9e21820ab7

    • SHA256

      3837831ce8b944076c88e4341840d20daa4c84e22fc64ce4c6a6f971e2bda8c5

    • SHA512

      d62e4863a6164d89341fb8e95bf93ddec58e36201ca2d34457c92ecedde249281e258e8a14ab1efd98fe4d928b3ab7b13a1015ae020c9f1955cc1f9a1a5a8c6b

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks