General

  • Target

    094386f4430b0357d98ae819b51cbe70N.exe

  • Size

    952KB

  • Sample

    240816-sx6acawcqp

  • MD5

    094386f4430b0357d98ae819b51cbe70

  • SHA1

    82029ed2fc638f66257f35ce305dc3c7851546ac

  • SHA256

    bab1ff2b5707a870c9f065a3e41574f7b673adb5496b570b064c509c043fb691

  • SHA512

    4d356eb6851cd1fec958e4d89478dd7d001e36fb50d29d70e21a38ff3ef5ac3d7bc8c2fed31ef64e94ae405f89b20040ce465394eb9d1b4bb21eacabf7a422b8

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5d:Rh+ZkldDPK8YaKjd

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      094386f4430b0357d98ae819b51cbe70N.exe

    • Size

      952KB

    • MD5

      094386f4430b0357d98ae819b51cbe70

    • SHA1

      82029ed2fc638f66257f35ce305dc3c7851546ac

    • SHA256

      bab1ff2b5707a870c9f065a3e41574f7b673adb5496b570b064c509c043fb691

    • SHA512

      4d356eb6851cd1fec958e4d89478dd7d001e36fb50d29d70e21a38ff3ef5ac3d7bc8c2fed31ef64e94ae405f89b20040ce465394eb9d1b4bb21eacabf7a422b8

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5d:Rh+ZkldDPK8YaKjd

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks