General

  • Target

    df9270b7f6f6e49e581d8b1df4d24530N.exe

  • Size

    952KB

  • Sample

    240817-rrl4vataqj

  • MD5

    df9270b7f6f6e49e581d8b1df4d24530

  • SHA1

    38fd2d9721ccfa758ff1b8dbde3fdc4936432ee9

  • SHA256

    71a634addb3423ee2f636108ffb192121287ce0d23edaad8382bb8288602e18c

  • SHA512

    6661e3d305bd7d36ed315030aea78b75204a438037d06dc3bc42411f12cf6b7169bd60e721d61dfbc4eaad146760e7083c20a6dc17b39f061bc1b98437d38940

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      df9270b7f6f6e49e581d8b1df4d24530N.exe

    • Size

      952KB

    • MD5

      df9270b7f6f6e49e581d8b1df4d24530

    • SHA1

      38fd2d9721ccfa758ff1b8dbde3fdc4936432ee9

    • SHA256

      71a634addb3423ee2f636108ffb192121287ce0d23edaad8382bb8288602e18c

    • SHA512

      6661e3d305bd7d36ed315030aea78b75204a438037d06dc3bc42411f12cf6b7169bd60e721d61dfbc4eaad146760e7083c20a6dc17b39f061bc1b98437d38940

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks