General

  • Target

    2ac1b38c3fd828d16f3e114f44bae6a0N.exe

  • Size

    952KB

  • Sample

    240815-p4ffqaxanq

  • MD5

    2ac1b38c3fd828d16f3e114f44bae6a0

  • SHA1

    2b7f8927758d11cc0a9d14d0cf308f759d63e1a5

  • SHA256

    659aef2b9cdc1f2de4f0adc2cd79c34e567751180efd478ba7bf4eb4dda3ea05

  • SHA512

    a61ca36686d88008a0439be93e14f74b932a999bc6c37f68082e316b0a3203b1062af653020c24c9bbb4931413f586bae608b575ed7ac33b4296e35e5f7c8e75

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5g:Rh+ZkldDPK8YaKjg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2ac1b38c3fd828d16f3e114f44bae6a0N.exe

    • Size

      952KB

    • MD5

      2ac1b38c3fd828d16f3e114f44bae6a0

    • SHA1

      2b7f8927758d11cc0a9d14d0cf308f759d63e1a5

    • SHA256

      659aef2b9cdc1f2de4f0adc2cd79c34e567751180efd478ba7bf4eb4dda3ea05

    • SHA512

      a61ca36686d88008a0439be93e14f74b932a999bc6c37f68082e316b0a3203b1062af653020c24c9bbb4931413f586bae608b575ed7ac33b4296e35e5f7c8e75

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5g:Rh+ZkldDPK8YaKjg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks