Overview

overview

10

Static

static

5

47efad7d93...9c.exe

windows7-x64

10

47efad7d93...9c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    47efad7d93a2b5a52abc589664f7e2c6fe3d288f59de6bd945bccfdcaf00bc9c

  • Size

    950KB

  • Sample

    240404-y61n4sab53

  • MD5

    4acb7ca96497911e85edd54355c116a5

  • SHA1

    ff3cd7b04eb16602abbf2586eb6f3fc4b65dd9b2

  • SHA256

    47efad7d93a2b5a52abc589664f7e2c6fe3d288f59de6bd945bccfdcaf00bc9c

  • SHA512

    84745232220bbe938382d659a7b878b0f2dd30686edf0a500a29856034315bca2dab10df47299b6da58ee1cb0f700023f1fa5490c6442f8edf1f58ebba8598e8

  • SSDEEP

    24576:2AHnh+eWsN3gkA4RV1Hom2KPMmHaKZT5k:Rh+RkldoPK0YaKjk

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      47efad7d93a2b5a52abc589664f7e2c6fe3d288f59de6bd945bccfdcaf00bc9c

    • Size

      950KB

    • MD5

      4acb7ca96497911e85edd54355c116a5

    • SHA1

      ff3cd7b04eb16602abbf2586eb6f3fc4b65dd9b2

    • SHA256

      47efad7d93a2b5a52abc589664f7e2c6fe3d288f59de6bd945bccfdcaf00bc9c

    • SHA512

      84745232220bbe938382d659a7b878b0f2dd30686edf0a500a29856034315bca2dab10df47299b6da58ee1cb0f700023f1fa5490c6442f8edf1f58ebba8598e8

    • SSDEEP

      24576:2AHnh+eWsN3gkA4RV1Hom2KPMmHaKZT5k:Rh+RkldoPK0YaKjk

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks