General

  • Target

    a00163cdab77a6dab0c517788b7723f0N.exe

  • Size

    952KB

  • Sample

    240825-t8fphawapp

  • MD5

    a00163cdab77a6dab0c517788b7723f0

  • SHA1

    9960ef1be0a822fa843af44911ed0ba652c1de61

  • SHA256

    06b1fc20ca4d237cd20c88f91b05b6f4e8f2ded2f2b360f1a55ff607a7ccde2d

  • SHA512

    dbaf0bba993bb1d6c1d75fce9d95ae8d8289a86b27fbc0051800f691690b2d0bcb873eca2342d5fcdf1a5c5fd2a21352155b044d06ab219b069bf1d42e478841

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a00163cdab77a6dab0c517788b7723f0N.exe

    • Size

      952KB

    • MD5

      a00163cdab77a6dab0c517788b7723f0

    • SHA1

      9960ef1be0a822fa843af44911ed0ba652c1de61

    • SHA256

      06b1fc20ca4d237cd20c88f91b05b6f4e8f2ded2f2b360f1a55ff607a7ccde2d

    • SHA512

      dbaf0bba993bb1d6c1d75fce9d95ae8d8289a86b27fbc0051800f691690b2d0bcb873eca2342d5fcdf1a5c5fd2a21352155b044d06ab219b069bf1d42e478841

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks