General

  • Target

    42e7fee8df253a338ea8b3f9b053a5e0N.exe

  • Size

    952KB

  • Sample

    240731-bscnssyhmm

  • MD5

    42e7fee8df253a338ea8b3f9b053a5e0

  • SHA1

    f2fa8e4daf2a47283752f90d6950be1858efb97e

  • SHA256

    8212fd7249198ed8c25835c67ca52b74eee1244919b184508db6ba8f9eb21be0

  • SHA512

    cdf70a2b90a0d382952e1de4e202d7fef8267b424d37e68db62a4aa6eb3dd3e1fd24493064650685d307c12249c843e007aa82b66490bd7e7d92d110b1930187

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      42e7fee8df253a338ea8b3f9b053a5e0N.exe

    • Size

      952KB

    • MD5

      42e7fee8df253a338ea8b3f9b053a5e0

    • SHA1

      f2fa8e4daf2a47283752f90d6950be1858efb97e

    • SHA256

      8212fd7249198ed8c25835c67ca52b74eee1244919b184508db6ba8f9eb21be0

    • SHA512

      cdf70a2b90a0d382952e1de4e202d7fef8267b424d37e68db62a4aa6eb3dd3e1fd24493064650685d307c12249c843e007aa82b66490bd7e7d92d110b1930187

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks