General

  • Target

    71d51607afccd09c410db3f872db3a70N.exe

  • Size

    952KB

  • Sample

    240821-mdqgwssgrf

  • MD5

    71d51607afccd09c410db3f872db3a70

  • SHA1

    1498a2c8d3987f4213d20566e6bb7c1c9050f93e

  • SHA256

    2fe7375bd9bd2eea680083639db8568aee0bd84b99ae1ae7f20ea3fefb1da1c8

  • SHA512

    8828b0694507118ee0865799bdd9c642c8967df5cba270cd2ef0c942be63ec1619600505ebc8eb35f50fd1f5ec579b54f25dec2b0c44807276adba2f8a1a6e94

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      71d51607afccd09c410db3f872db3a70N.exe

    • Size

      952KB

    • MD5

      71d51607afccd09c410db3f872db3a70

    • SHA1

      1498a2c8d3987f4213d20566e6bb7c1c9050f93e

    • SHA256

      2fe7375bd9bd2eea680083639db8568aee0bd84b99ae1ae7f20ea3fefb1da1c8

    • SHA512

      8828b0694507118ee0865799bdd9c642c8967df5cba270cd2ef0c942be63ec1619600505ebc8eb35f50fd1f5ec579b54f25dec2b0c44807276adba2f8a1a6e94

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5r:Rh+ZkldDPK8YaKjr

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks