General

  • Target

    b8c3db488409b9e5310ab051976bb730N.exe

  • Size

    952KB

  • Sample

    240824-cb5tpazckh

  • MD5

    b8c3db488409b9e5310ab051976bb730

  • SHA1

    be970fe44852f718b34cd41aee308ee03c5ae137

  • SHA256

    849e0e75626ed27f2bd6d43d1b1314b9635ad9f3cc2710586f6ba736a92e612a

  • SHA512

    b7e5f1ba97f5f43182770df44a7fac9da50fca526c246ba498a35d9952ada98685c1b0825197926d5ce2723c58920b119ab35a736803ad057f3ae68b9b6c7cd9

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT52:Rh+ZkldDPK8YaKj2

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b8c3db488409b9e5310ab051976bb730N.exe

    • Size

      952KB

    • MD5

      b8c3db488409b9e5310ab051976bb730

    • SHA1

      be970fe44852f718b34cd41aee308ee03c5ae137

    • SHA256

      849e0e75626ed27f2bd6d43d1b1314b9635ad9f3cc2710586f6ba736a92e612a

    • SHA512

      b7e5f1ba97f5f43182770df44a7fac9da50fca526c246ba498a35d9952ada98685c1b0825197926d5ce2723c58920b119ab35a736803ad057f3ae68b9b6c7cd9

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT52:Rh+ZkldDPK8YaKj2

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks