General

  • Target

    0f6209fd2d6bce54d63083e6d275e070N.exe

  • Size

    951KB

  • Sample

    240715-z5fszsscmc

  • MD5

    0f6209fd2d6bce54d63083e6d275e070

  • SHA1

    86753bd0eafd17dc2b9ca242051cbc0970d5c983

  • SHA256

    fc71ba575f030b11ab4c86ad6ac8d2bae7f50853c7dabafa15525d9fac10aad7

  • SHA512

    9188909d37776b4a581f08dce255027dcab4e19232e8045af4768ea5855e45ec6c4f838616aab1163a8f581b81e8ae467d2a824e27e2f3d5d7e27b34359630f9

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5l:Rh+ZkldDPK8YaKjl

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      0f6209fd2d6bce54d63083e6d275e070N.exe

    • Size

      951KB

    • MD5

      0f6209fd2d6bce54d63083e6d275e070

    • SHA1

      86753bd0eafd17dc2b9ca242051cbc0970d5c983

    • SHA256

      fc71ba575f030b11ab4c86ad6ac8d2bae7f50853c7dabafa15525d9fac10aad7

    • SHA512

      9188909d37776b4a581f08dce255027dcab4e19232e8045af4768ea5855e45ec6c4f838616aab1163a8f581b81e8ae467d2a824e27e2f3d5d7e27b34359630f9

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5l:Rh+ZkldDPK8YaKjl

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks