General

  • Target

    2d6fce4eb3c453486308a873f380dbe0N.exe

  • Size

    952KB

  • Sample

    240813-3w27eawgmm

  • MD5

    2d6fce4eb3c453486308a873f380dbe0

  • SHA1

    f6f1208ff8291024b80deb233fe7020376397934

  • SHA256

    86c93e7233c0d22e104fadc7ff4ed7c9476384a4618654aae0ec2effc9478faa

  • SHA512

    21acb2c91190bfbbf15f8bcb18c2727d1017b451fc52fc7e5bcb2f2040a9eba8155d7305c5df5bc4d713139a1b8be01e5cab7462d5f56e61e85516ef0a4fd0d8

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5X:Rh+ZkldDPK8YaKjX

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2d6fce4eb3c453486308a873f380dbe0N.exe

    • Size

      952KB

    • MD5

      2d6fce4eb3c453486308a873f380dbe0

    • SHA1

      f6f1208ff8291024b80deb233fe7020376397934

    • SHA256

      86c93e7233c0d22e104fadc7ff4ed7c9476384a4618654aae0ec2effc9478faa

    • SHA512

      21acb2c91190bfbbf15f8bcb18c2727d1017b451fc52fc7e5bcb2f2040a9eba8155d7305c5df5bc4d713139a1b8be01e5cab7462d5f56e61e85516ef0a4fd0d8

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5X:Rh+ZkldDPK8YaKjX

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks