General

  • Target

    eac91d62d3b24d6c1c0323674ad6d300N.exe

  • Size

    952KB

  • Sample

    240820-xtqspsycqc

  • MD5

    eac91d62d3b24d6c1c0323674ad6d300

  • SHA1

    aa5ff77ea22085fbc8d960809504602dbd07b645

  • SHA256

    5f83a8d5469d2411d2ec46c25c29b61f62d2fe3f2411a7c1573aae47e339e363

  • SHA512

    e226f6e9ded219f4cbef2524bc92f8eb91b08cbd4bd31643f55d27db09df754fa800334248c4d2db7b8edd723b90e4ba476c4897a3919573639f592f01017094

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5L:Rh+ZkldDPK8YaKjL

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      eac91d62d3b24d6c1c0323674ad6d300N.exe

    • Size

      952KB

    • MD5

      eac91d62d3b24d6c1c0323674ad6d300

    • SHA1

      aa5ff77ea22085fbc8d960809504602dbd07b645

    • SHA256

      5f83a8d5469d2411d2ec46c25c29b61f62d2fe3f2411a7c1573aae47e339e363

    • SHA512

      e226f6e9ded219f4cbef2524bc92f8eb91b08cbd4bd31643f55d27db09df754fa800334248c4d2db7b8edd723b90e4ba476c4897a3919573639f592f01017094

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5L:Rh+ZkldDPK8YaKjL

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks