General

  • Target

    7586403d5d5d1ebdd228419f2536ad60N.exe

  • Size

    952KB

  • Sample

    240807-grv2msshpk

  • MD5

    7586403d5d5d1ebdd228419f2536ad60

  • SHA1

    a1feaadbf02303ebdbc1545a16e7190f0e7943b6

  • SHA256

    5a7e19f8f0dd8ce612f5bb8356d4d235933c6352d632f551e60d2ac357185b86

  • SHA512

    ed680c6b359a9d559c3518fe6bc131797a7923314f7bdce579cf48e33d5d8718b60f279bbdecef127f084059a45c6da5cb8f37437992b9d8a8fbfb62bd56727f

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5N:Rh+ZkldDPK8YaKjN

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      7586403d5d5d1ebdd228419f2536ad60N.exe

    • Size

      952KB

    • MD5

      7586403d5d5d1ebdd228419f2536ad60

    • SHA1

      a1feaadbf02303ebdbc1545a16e7190f0e7943b6

    • SHA256

      5a7e19f8f0dd8ce612f5bb8356d4d235933c6352d632f551e60d2ac357185b86

    • SHA512

      ed680c6b359a9d559c3518fe6bc131797a7923314f7bdce579cf48e33d5d8718b60f279bbdecef127f084059a45c6da5cb8f37437992b9d8a8fbfb62bd56727f

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5N:Rh+ZkldDPK8YaKjN

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks