General

  • Target

    fc7441b58315bbf6aa4775a9d0988d20N.exe

  • Size

    952KB

  • Sample

    240819-eqmmrsxbkm

  • MD5

    fc7441b58315bbf6aa4775a9d0988d20

  • SHA1

    52a8e46b0e12cd67d02481607fbbb2c733ae1bcb

  • SHA256

    9deddf59b30fe2c59afedec06e8d1c93be564e2e11bb24037f1d9ab1d0366f6c

  • SHA512

    bd3e65316ebd0dd17d235fe1b905e488a353f4e9ba9913a4b494ab50d4e6d9e66d40acf4233a93ea907e6027132b8a8969e6845f1c5d1009e25c1d857ce80f54

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5m:Rh+ZkldDPK8YaKjm

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      fc7441b58315bbf6aa4775a9d0988d20N.exe

    • Size

      952KB

    • MD5

      fc7441b58315bbf6aa4775a9d0988d20

    • SHA1

      52a8e46b0e12cd67d02481607fbbb2c733ae1bcb

    • SHA256

      9deddf59b30fe2c59afedec06e8d1c93be564e2e11bb24037f1d9ab1d0366f6c

    • SHA512

      bd3e65316ebd0dd17d235fe1b905e488a353f4e9ba9913a4b494ab50d4e6d9e66d40acf4233a93ea907e6027132b8a8969e6845f1c5d1009e25c1d857ce80f54

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5m:Rh+ZkldDPK8YaKjm

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks