General

  • Target

    1a3683e7a5941cc6270a0f9bb316c1e0N.exe

  • Size

    903KB

  • Sample

    240817-lh895asanl

  • MD5

    1a3683e7a5941cc6270a0f9bb316c1e0

  • SHA1

    480931d265470772e0f1391cdc6845d7aa8ef958

  • SHA256

    dcb6c9dffa419e9be5bfc5850ee9dff6c4450af316006321e31ff87e9fea07c5

  • SHA512

    14e700c13aeaae4820f07a3d0d4feb67bac6b022cefe156f9bd7e74fe77b636914f94b2f35f2d1376416a1e87857859afcd329e7017bf0c89d666438b843ce43

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1a3683e7a5941cc6270a0f9bb316c1e0N.exe

    • Size

      903KB

    • MD5

      1a3683e7a5941cc6270a0f9bb316c1e0

    • SHA1

      480931d265470772e0f1391cdc6845d7aa8ef958

    • SHA256

      dcb6c9dffa419e9be5bfc5850ee9dff6c4450af316006321e31ff87e9fea07c5

    • SHA512

      14e700c13aeaae4820f07a3d0d4feb67bac6b022cefe156f9bd7e74fe77b636914f94b2f35f2d1376416a1e87857859afcd329e7017bf0c89d666438b843ce43

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5h:gh+ZkldoPK8YaKGh

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks