General

  • Target

    45338701c17a7a73a18f0accf7d53d10N.exe

  • Size

    951KB

  • Sample

    240713-et4qfsvgkn

  • MD5

    45338701c17a7a73a18f0accf7d53d10

  • SHA1

    17cdf41c6adf5434eb5d6ad1bb6631df9223ca6e

  • SHA256

    988e6fa88a084886b1d8807a600db957e35707b4ef3355794b41f6be4630725e

  • SHA512

    e7e0572088e2fa59a851c5b146eb03448e2f56167ae612c681c50ab0a697c6fcd1462c82544ccf6da179c38d0b6d6f4d385eb763d7c7c606bb3e0e3a141d0773

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5T:Rh+ZkldDPK8YaKjT

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      45338701c17a7a73a18f0accf7d53d10N.exe

    • Size

      951KB

    • MD5

      45338701c17a7a73a18f0accf7d53d10

    • SHA1

      17cdf41c6adf5434eb5d6ad1bb6631df9223ca6e

    • SHA256

      988e6fa88a084886b1d8807a600db957e35707b4ef3355794b41f6be4630725e

    • SHA512

      e7e0572088e2fa59a851c5b146eb03448e2f56167ae612c681c50ab0a697c6fcd1462c82544ccf6da179c38d0b6d6f4d385eb763d7c7c606bb3e0e3a141d0773

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5T:Rh+ZkldDPK8YaKjT

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks