General

  • Target

    d565aa782e55a7dd90ed4cef56103f30N.exe

  • Size

    951KB

  • Sample

    240803-znrtxsvdrl

  • MD5

    d565aa782e55a7dd90ed4cef56103f30

  • SHA1

    a5a8456e3d60aae93031610a8d4aba925be270e9

  • SHA256

    1277229d562fed8709676f4fef7eedc696b1ce9631613871d5fdb38ebd4b5563

  • SHA512

    e9a17149f6455413e771189e5e977a7a634bb32ee76307119e38bce5021010db7156a023221041cd5125bc6e85bdd5eb23ddf1b2a954625ff251188a36659f5e

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d565aa782e55a7dd90ed4cef56103f30N.exe

    • Size

      951KB

    • MD5

      d565aa782e55a7dd90ed4cef56103f30

    • SHA1

      a5a8456e3d60aae93031610a8d4aba925be270e9

    • SHA256

      1277229d562fed8709676f4fef7eedc696b1ce9631613871d5fdb38ebd4b5563

    • SHA512

      e9a17149f6455413e771189e5e977a7a634bb32ee76307119e38bce5021010db7156a023221041cd5125bc6e85bdd5eb23ddf1b2a954625ff251188a36659f5e

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks