General

  • Target

    e3f1bc66efb7046d698222a75fe1f5e0N.exe

  • Size

    952KB

  • Sample

    240820-l88fhswdlh

  • MD5

    e3f1bc66efb7046d698222a75fe1f5e0

  • SHA1

    f947545b723ab61ecda5c08a6570d4788c06921a

  • SHA256

    c6decfcdac7cfd1d389e7db979b305d17293b80f0f422e59ef2c239022a9986b

  • SHA512

    4def770a323d089996af2f8e740ad6f509b0f08b8eddf9bc60f1c50dc61895fb452b34585fdef563fc716c6c546a88b9b4e869c66b907a311e716d3cf1c56701

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5g:Rh+ZkldDPK8YaKjg

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e3f1bc66efb7046d698222a75fe1f5e0N.exe

    • Size

      952KB

    • MD5

      e3f1bc66efb7046d698222a75fe1f5e0

    • SHA1

      f947545b723ab61ecda5c08a6570d4788c06921a

    • SHA256

      c6decfcdac7cfd1d389e7db979b305d17293b80f0f422e59ef2c239022a9986b

    • SHA512

      4def770a323d089996af2f8e740ad6f509b0f08b8eddf9bc60f1c50dc61895fb452b34585fdef563fc716c6c546a88b9b4e869c66b907a311e716d3cf1c56701

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5g:Rh+ZkldDPK8YaKjg

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks