Overview

overview

10

Static

static

5

f91f3a5d5c...0N.exe

windows7-x64

10

f91f3a5d5c...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f91f3a5d5c3cd08f67eaf5c8347cc740N.exe

  • Size

    952KB

  • Sample

    240721-wlc17sxhmg

  • MD5

    f91f3a5d5c3cd08f67eaf5c8347cc740

  • SHA1

    203462a8a9f69bfd6c1b5a21228db16f4289074c

  • SHA256

    07dbdc6985b4ab7d6c6bef99e28d2f9696708b6ede80021881ed23c781f67e29

  • SHA512

    7dd167ba24726a32e0006457936969498a2f2280d48d6ea2e60e12a4e83ddcb47ead8ca30bc297b567df2525341928a3f0f9f9b794087c3c9b2f59fdf4123b19

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT51:Rh+ZkldDPK8YaKj1

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f91f3a5d5c3cd08f67eaf5c8347cc740N.exe

    • Size

      952KB

    • MD5

      f91f3a5d5c3cd08f67eaf5c8347cc740

    • SHA1

      203462a8a9f69bfd6c1b5a21228db16f4289074c

    • SHA256

      07dbdc6985b4ab7d6c6bef99e28d2f9696708b6ede80021881ed23c781f67e29

    • SHA512

      7dd167ba24726a32e0006457936969498a2f2280d48d6ea2e60e12a4e83ddcb47ead8ca30bc297b567df2525341928a3f0f9f9b794087c3c9b2f59fdf4123b19

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT51:Rh+ZkldDPK8YaKj1

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks