General

  • Target

    3d41513a6735c15a89e83be9108139c0N.exe

  • Size

    951KB

  • Sample

    240713-d28tpstfjl

  • MD5

    3d41513a6735c15a89e83be9108139c0

  • SHA1

    35af4a7fa36cbb14ebb740e55959e66a8facf4ba

  • SHA256

    9d451b023aaac2a3ceb24cdadb5fb9f8c6b51ce803304805ca37e560e083e1c6

  • SHA512

    722d3bc819f40aeb0653ecd31d5947551b39a56d965a9e7a136825122cd72870ec44e44dc933401b988c1864dd6e6d96862a12fb02ddaeca7868d49bfc71f3ee

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3d41513a6735c15a89e83be9108139c0N.exe

    • Size

      951KB

    • MD5

      3d41513a6735c15a89e83be9108139c0

    • SHA1

      35af4a7fa36cbb14ebb740e55959e66a8facf4ba

    • SHA256

      9d451b023aaac2a3ceb24cdadb5fb9f8c6b51ce803304805ca37e560e083e1c6

    • SHA512

      722d3bc819f40aeb0653ecd31d5947551b39a56d965a9e7a136825122cd72870ec44e44dc933401b988c1864dd6e6d96862a12fb02ddaeca7868d49bfc71f3ee

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks