General

  • Target

    64259e2a038dd2e4ee4bd20003500610N.exe

  • Size

    952KB

  • Sample

    240820-3vjnnszcle

  • MD5

    64259e2a038dd2e4ee4bd20003500610

  • SHA1

    90006e36755caaab3cb035568544aeb516d7d7dc

  • SHA256

    42eaba4e37f3dabcd3db22a9ffe87bcdbf550ef055655028cc82753d343baef5

  • SHA512

    87e8a3d6334912cda461b2e91b9b8ccf775e30f5677d2e941cd51343e89820dae86a11ae6c90c0433a83d1ea5a262de02c2c61233b423f2db78e3dcdadb12f9e

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5v:Rh+ZkldDPK8YaKjv

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      64259e2a038dd2e4ee4bd20003500610N.exe

    • Size

      952KB

    • MD5

      64259e2a038dd2e4ee4bd20003500610

    • SHA1

      90006e36755caaab3cb035568544aeb516d7d7dc

    • SHA256

      42eaba4e37f3dabcd3db22a9ffe87bcdbf550ef055655028cc82753d343baef5

    • SHA512

      87e8a3d6334912cda461b2e91b9b8ccf775e30f5677d2e941cd51343e89820dae86a11ae6c90c0433a83d1ea5a262de02c2c61233b423f2db78e3dcdadb12f9e

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5v:Rh+ZkldDPK8YaKjv

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks