General

  • Target

    67d21a3fd60351c3d71af8f141f787d0N.exe

  • Size

    952KB

  • Sample

    240817-3bz7bawbjj

  • MD5

    67d21a3fd60351c3d71af8f141f787d0

  • SHA1

    94e160b41ab1c132b32584753d5b79163e6b7940

  • SHA256

    3c61d606dc64ba3d57101b66d56fdd24c7f42491d0a338246148ff472e2ab852

  • SHA512

    c73e2866aa3cf14b887ecc83521f858b90aff987bf7663b34d6b89a7a7766246b1378a8ac722a9b72c7789df7d545ad97686e2cfa0366eab628acefa9fb7fa7a

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5K:Rh+ZkldDPK8YaKjK

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      67d21a3fd60351c3d71af8f141f787d0N.exe

    • Size

      952KB

    • MD5

      67d21a3fd60351c3d71af8f141f787d0

    • SHA1

      94e160b41ab1c132b32584753d5b79163e6b7940

    • SHA256

      3c61d606dc64ba3d57101b66d56fdd24c7f42491d0a338246148ff472e2ab852

    • SHA512

      c73e2866aa3cf14b887ecc83521f858b90aff987bf7663b34d6b89a7a7766246b1378a8ac722a9b72c7789df7d545ad97686e2cfa0366eab628acefa9fb7fa7a

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5K:Rh+ZkldDPK8YaKjK

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks