General

  • Target

    d50cef23b0a8ace42d155a2145bc2030N.exe

  • Size

    952KB

  • Sample

    240819-hfv3yazanb

  • MD5

    d50cef23b0a8ace42d155a2145bc2030

  • SHA1

    169c37caaf8b6d0dc44a480f4f822f476909d759

  • SHA256

    e97d4a8d15d0891c0f1c600c85f140cf0b925907fc4a1906a899ba74cb021c9a

  • SHA512

    159a43bd1e809549045677f25c569a41392aff03ee7b176f94cd723a26df12c485b3df076fd66228ad028a43cbe44688413142a35fa12baeaa38e27448dfb305

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d50cef23b0a8ace42d155a2145bc2030N.exe

    • Size

      952KB

    • MD5

      d50cef23b0a8ace42d155a2145bc2030

    • SHA1

      169c37caaf8b6d0dc44a480f4f822f476909d759

    • SHA256

      e97d4a8d15d0891c0f1c600c85f140cf0b925907fc4a1906a899ba74cb021c9a

    • SHA512

      159a43bd1e809549045677f25c569a41392aff03ee7b176f94cd723a26df12c485b3df076fd66228ad028a43cbe44688413142a35fa12baeaa38e27448dfb305

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks