General

  • Target

    041c126104196c9b830ef2957183d780N.exe

  • Size

    952KB

  • Sample

    240804-zvwrfswcpk

  • MD5

    041c126104196c9b830ef2957183d780

  • SHA1

    732806deebdc8437b74c60909e6e47c80a5c88b8

  • SHA256

    f8880b08cdd991f3c49990be467f4a08ee46d1bb5b1873b7cbad8a78b225ac00

  • SHA512

    31c863b18193699efac9c717beea239920418d267408b71a3ac925fa1557f0a2404b757bfc789577239bf462e6b837a9bdc9b2f2627fbb8e5064a4fa3d991aee

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT59:Rh+ZkldDPK8YaKj9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      041c126104196c9b830ef2957183d780N.exe

    • Size

      952KB

    • MD5

      041c126104196c9b830ef2957183d780

    • SHA1

      732806deebdc8437b74c60909e6e47c80a5c88b8

    • SHA256

      f8880b08cdd991f3c49990be467f4a08ee46d1bb5b1873b7cbad8a78b225ac00

    • SHA512

      31c863b18193699efac9c717beea239920418d267408b71a3ac925fa1557f0a2404b757bfc789577239bf462e6b837a9bdc9b2f2627fbb8e5064a4fa3d991aee

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT59:Rh+ZkldDPK8YaKj9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks