General

  • Target

    f1a60d392888e0b2a993c0f0601c5870N.exe

  • Size

    951KB

  • Sample

    240804-sgz4dsxhkk

  • MD5

    f1a60d392888e0b2a993c0f0601c5870

  • SHA1

    15c9f119b53fa02d46a1a32243e81186fd813508

  • SHA256

    6018d4d126861351f2fdbf13144c80d4574c7c6074d72fb9d3ccf6fedd2fac07

  • SHA512

    211e8219e7199557b53c6c8917aa8d4402aaa47d27bb6d1111601566cb65285fcb543978cae6567317145ce4828a9cc71ebb145676ff9694d9ca711402e3e0db

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f1a60d392888e0b2a993c0f0601c5870N.exe

    • Size

      951KB

    • MD5

      f1a60d392888e0b2a993c0f0601c5870

    • SHA1

      15c9f119b53fa02d46a1a32243e81186fd813508

    • SHA256

      6018d4d126861351f2fdbf13144c80d4574c7c6074d72fb9d3ccf6fedd2fac07

    • SHA512

      211e8219e7199557b53c6c8917aa8d4402aaa47d27bb6d1111601566cb65285fcb543978cae6567317145ce4828a9cc71ebb145676ff9694d9ca711402e3e0db

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks