General

  • Target

    cc0f0ef02683d5969ef36855a009a350N.exe

  • Size

    952KB

  • Sample

    240819-j2dapasgpg

  • MD5

    cc0f0ef02683d5969ef36855a009a350

  • SHA1

    ac094738deeda76e96e0d7b8c85e3d37e9181c18

  • SHA256

    e1028f9432ca2ca58897ef542baed28a13238f57ef49cce0fbf0ca02282eb368

  • SHA512

    d39863cd4b0920121f9baa451073bd2de50e8d6b3591702ea8c573ca7db43e435888d6189b8645016f3e2c9bc9c4cb4eccfbab72f13a430da181b7b2a70749cc

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5A:Rh+ZkldDPK8YaKjA

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      cc0f0ef02683d5969ef36855a009a350N.exe

    • Size

      952KB

    • MD5

      cc0f0ef02683d5969ef36855a009a350

    • SHA1

      ac094738deeda76e96e0d7b8c85e3d37e9181c18

    • SHA256

      e1028f9432ca2ca58897ef542baed28a13238f57ef49cce0fbf0ca02282eb368

    • SHA512

      d39863cd4b0920121f9baa451073bd2de50e8d6b3591702ea8c573ca7db43e435888d6189b8645016f3e2c9bc9c4cb4eccfbab72f13a430da181b7b2a70749cc

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5A:Rh+ZkldDPK8YaKjA

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks