General

  • Target

    35ecd26ff59c9f8817fa3d085edcb1d0N.exe

  • Size

    952KB

  • Sample

    240817-mh7lzatfkk

  • MD5

    35ecd26ff59c9f8817fa3d085edcb1d0

  • SHA1

    254ebf3266aaee2c06dd9b5ae647e5eb6691b4ba

  • SHA256

    7bba5cb70c39b9f761497b854d0f68b60286f90d082144462825a3fb7410c4f2

  • SHA512

    14893941872e027e6bd75469382d35e8c4d24a201330d1e686aecd3af79c1a14ce0d970f211547600d1b6f37f57da59f4594abc25f3572e1815e0146e980a594

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      35ecd26ff59c9f8817fa3d085edcb1d0N.exe

    • Size

      952KB

    • MD5

      35ecd26ff59c9f8817fa3d085edcb1d0

    • SHA1

      254ebf3266aaee2c06dd9b5ae647e5eb6691b4ba

    • SHA256

      7bba5cb70c39b9f761497b854d0f68b60286f90d082144462825a3fb7410c4f2

    • SHA512

      14893941872e027e6bd75469382d35e8c4d24a201330d1e686aecd3af79c1a14ce0d970f211547600d1b6f37f57da59f4594abc25f3572e1815e0146e980a594

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks