General

  • Target

    c2eb1d928c468694464a42f873a350d0N.exe

  • Size

    952KB

  • Sample

    240824-y4skqaxdrb

  • MD5

    c2eb1d928c468694464a42f873a350d0

  • SHA1

    9dc5296a120cb67dc0133ce6610ef3a5c8c1526d

  • SHA256

    b01cd67d0606f53c1d53099059d5a289e98db40457a436754aafa587b50bd993

  • SHA512

    6a8d874c38c812183b5124bcd525d95b4f10e29e2a78088e42fa3c6bc83226d3cb71ea4a416cd6bc9e7d9cbd04ec08c499f03253d122d9d140618e6fd367f82b

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c2eb1d928c468694464a42f873a350d0N.exe

    • Size

      952KB

    • MD5

      c2eb1d928c468694464a42f873a350d0

    • SHA1

      9dc5296a120cb67dc0133ce6610ef3a5c8c1526d

    • SHA256

      b01cd67d0606f53c1d53099059d5a289e98db40457a436754aafa587b50bd993

    • SHA512

      6a8d874c38c812183b5124bcd525d95b4f10e29e2a78088e42fa3c6bc83226d3cb71ea4a416cd6bc9e7d9cbd04ec08c499f03253d122d9d140618e6fd367f82b

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks