General

  • Target

    e1a370beb844a74231a8d9368c672460N.exe

  • Size

    952KB

  • Sample

    240818-qaa5ksxcpj

  • MD5

    e1a370beb844a74231a8d9368c672460

  • SHA1

    0571fb9a4aaaa82866a89cbdc480d7347a3606c7

  • SHA256

    b1d31be30965ecd22383d41434f0f9cd581cde468d612a2cf218fae4e74b8725

  • SHA512

    088513e172aaaf2cc44e1e41b33669974bf70f22af55083524e3751f2b6296d7a4b77dbadf9c438180d7e1f84f07ebe73c6c5a17570e63df144ac2b89c5614bf

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e1a370beb844a74231a8d9368c672460N.exe

    • Size

      952KB

    • MD5

      e1a370beb844a74231a8d9368c672460

    • SHA1

      0571fb9a4aaaa82866a89cbdc480d7347a3606c7

    • SHA256

      b1d31be30965ecd22383d41434f0f9cd581cde468d612a2cf218fae4e74b8725

    • SHA512

      088513e172aaaf2cc44e1e41b33669974bf70f22af55083524e3751f2b6296d7a4b77dbadf9c438180d7e1f84f07ebe73c6c5a17570e63df144ac2b89c5614bf

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks