General

  • Target

    b6b0966f67311c1aae001a3a8b919b70N.exe

  • Size

    952KB

  • Sample

    240731-p3eg2atfqr

  • MD5

    b6b0966f67311c1aae001a3a8b919b70

  • SHA1

    6f2b2920fa59b41aa7db2c9833982e0518400747

  • SHA256

    cb60d3324714e52322fcd5c932303e6006523242af09e0bd77aa1c653d42a769

  • SHA512

    54ab8c399e848a6b627a18f587f720d532c13b7afb0e5ccd4b0ffac7bda7e0a9726abe9987da2db3c0baab7d855d3679d050349119852877b7285a52165411e0

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b6b0966f67311c1aae001a3a8b919b70N.exe

    • Size

      952KB

    • MD5

      b6b0966f67311c1aae001a3a8b919b70

    • SHA1

      6f2b2920fa59b41aa7db2c9833982e0518400747

    • SHA256

      cb60d3324714e52322fcd5c932303e6006523242af09e0bd77aa1c653d42a769

    • SHA512

      54ab8c399e848a6b627a18f587f720d532c13b7afb0e5ccd4b0ffac7bda7e0a9726abe9987da2db3c0baab7d855d3679d050349119852877b7285a52165411e0

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks