General

  • Target

    d669ea97760441c8e6b6032f77838560N.exe

  • Size

    952KB

  • Sample

    240815-xqxf3syclc

  • MD5

    d669ea97760441c8e6b6032f77838560

  • SHA1

    1d6b04993dcfc22860cee9793dbcf346d6d33010

  • SHA256

    dc2e647b6eaefef7e8d4b1f3d0587b7e9c860fd4455fb5026f360daed1e92e15

  • SHA512

    1caf36f86efabc1fbef6c9664b8db81839eadc05def7376c039aa1b436baebf9df441ffa1d56a40423eca7e231798a8c8c7eb17f8373c65da42f859840e24893

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d669ea97760441c8e6b6032f77838560N.exe

    • Size

      952KB

    • MD5

      d669ea97760441c8e6b6032f77838560

    • SHA1

      1d6b04993dcfc22860cee9793dbcf346d6d33010

    • SHA256

      dc2e647b6eaefef7e8d4b1f3d0587b7e9c860fd4455fb5026f360daed1e92e15

    • SHA512

      1caf36f86efabc1fbef6c9664b8db81839eadc05def7376c039aa1b436baebf9df441ffa1d56a40423eca7e231798a8c8c7eb17f8373c65da42f859840e24893

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks