Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2971536e5979f598a41d1d2457e79090N.exe

  • Size

    952KB

  • Sample

    240819-2rvq4atfnq

  • MD5

    2971536e5979f598a41d1d2457e79090

  • SHA1

    a4cc9c6245bea06855ef8cbad8cc99ae17b925a0

  • SHA256

    9ef7012fd98834e58c918f2b49e3615ea7f17886a63928587116a5f06fe54ac7

  • SHA512

    786bb471146cebeb2ef5e5da7f30d1756d82b665a52bdcf325b8d3fbb58a1172fdb6ab464071ffd7d8a9427646501951fe9ee922d5536c0442ae4e552017c699

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2971536e5979f598a41d1d2457e79090N.exe

    • Size

      952KB

    • MD5

      2971536e5979f598a41d1d2457e79090

    • SHA1

      a4cc9c6245bea06855ef8cbad8cc99ae17b925a0

    • SHA256

      9ef7012fd98834e58c918f2b49e3615ea7f17886a63928587116a5f06fe54ac7

    • SHA512

      786bb471146cebeb2ef5e5da7f30d1756d82b665a52bdcf325b8d3fbb58a1172fdb6ab464071ffd7d8a9427646501951fe9ee922d5536c0442ae4e552017c699

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks