General

  • Target

    97495c0c57ea25224a24be373cc41bc0N.exe

  • Size

    952KB

  • Sample

    240807-kwgatswcnq

  • MD5

    97495c0c57ea25224a24be373cc41bc0

  • SHA1

    ce98ae0ddb88294a6d934c6f70155b78ed5d5251

  • SHA256

    3037b65c9553513fd8942bd9bb1f424e50b77c69fc07cc8c2a750ee0d785bedb

  • SHA512

    96758b69e8ef3a07a99a1ee39a0608e6df607529b53e869925068e11e6f6db8e43ecf28ca4d1d36fc5c59dbc071ed7045606fa9d657bfda860e42408bd3642d6

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      97495c0c57ea25224a24be373cc41bc0N.exe

    • Size

      952KB

    • MD5

      97495c0c57ea25224a24be373cc41bc0

    • SHA1

      ce98ae0ddb88294a6d934c6f70155b78ed5d5251

    • SHA256

      3037b65c9553513fd8942bd9bb1f424e50b77c69fc07cc8c2a750ee0d785bedb

    • SHA512

      96758b69e8ef3a07a99a1ee39a0608e6df607529b53e869925068e11e6f6db8e43ecf28ca4d1d36fc5c59dbc071ed7045606fa9d657bfda860e42408bd3642d6

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks