General

  • Target

    4695720b380c8316229d185e2f6258d0N.exe

  • Size

    952KB

  • Sample

    240820-pdg7mavdqm

  • MD5

    4695720b380c8316229d185e2f6258d0

  • SHA1

    cf22e6ad4bd0ef857275a3ae66f98d94d86b6aed

  • SHA256

    947977dd98355c0d887e708a6c8bf42d56e46d8c65000065a9051e2dcdcbfbdc

  • SHA512

    012b72005ea8e2dcc164804ff61ab2085b3381c8e0a0e18aec8823507c018ee02ce3df66434747725a67ebcb3c62c7477f1456e88e07672f541407580cb9b8c3

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5x:Rh+ZkldDPK8YaKjx

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4695720b380c8316229d185e2f6258d0N.exe

    • Size

      952KB

    • MD5

      4695720b380c8316229d185e2f6258d0

    • SHA1

      cf22e6ad4bd0ef857275a3ae66f98d94d86b6aed

    • SHA256

      947977dd98355c0d887e708a6c8bf42d56e46d8c65000065a9051e2dcdcbfbdc

    • SHA512

      012b72005ea8e2dcc164804ff61ab2085b3381c8e0a0e18aec8823507c018ee02ce3df66434747725a67ebcb3c62c7477f1456e88e07672f541407580cb9b8c3

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5x:Rh+ZkldDPK8YaKjx

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks