General

  • Target

    a8d932a3f8475d72abfce462ea2e1970N.exe

  • Size

    952KB

  • Sample

    240807-md8cpsxbrp

  • MD5

    a8d932a3f8475d72abfce462ea2e1970

  • SHA1

    8e91569b373365a9a33fd9a06ba6cb70dd47fbf4

  • SHA256

    f812abaee0a2ac9efcaf06e262526b57fd0fc781787d96f95b88162607381632

  • SHA512

    a093acce17d2f7b94bdbf3e758f981f89f2ce473ee50a2ddac8246cf2b5b28b637006e67bc16f7501233baa941ee6b6f7e6669d270b39014dbe4171facb39a01

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT57:Rh+ZkldDPK8YaKj7

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a8d932a3f8475d72abfce462ea2e1970N.exe

    • Size

      952KB

    • MD5

      a8d932a3f8475d72abfce462ea2e1970

    • SHA1

      8e91569b373365a9a33fd9a06ba6cb70dd47fbf4

    • SHA256

      f812abaee0a2ac9efcaf06e262526b57fd0fc781787d96f95b88162607381632

    • SHA512

      a093acce17d2f7b94bdbf3e758f981f89f2ce473ee50a2ddac8246cf2b5b28b637006e67bc16f7501233baa941ee6b6f7e6669d270b39014dbe4171facb39a01

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT57:Rh+ZkldDPK8YaKj7

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks