General

  • Target

    8f82331f0f8087e4c9873e43fee1e590N.exe

  • Size

    952KB

  • Sample

    240904-cjdp6stamj

  • MD5

    8f82331f0f8087e4c9873e43fee1e590

  • SHA1

    54a4a2591ae877909b2eb1c705d6849375912f64

  • SHA256

    8960b911a4d3c5a128a9542ea5cf337efa9d861b2ad0a0076bcd60bf9e23de7d

  • SHA512

    fc6b1c1a1891fcda2f828856e941be18c707672fbd4419f26b7ca382bb00bfb524a5d9e40ade39f371ee3e7314b232acf2e13958113a6ba4854349d1786abc15

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8f82331f0f8087e4c9873e43fee1e590N.exe

    • Size

      952KB

    • MD5

      8f82331f0f8087e4c9873e43fee1e590

    • SHA1

      54a4a2591ae877909b2eb1c705d6849375912f64

    • SHA256

      8960b911a4d3c5a128a9542ea5cf337efa9d861b2ad0a0076bcd60bf9e23de7d

    • SHA512

      fc6b1c1a1891fcda2f828856e941be18c707672fbd4419f26b7ca382bb00bfb524a5d9e40ade39f371ee3e7314b232acf2e13958113a6ba4854349d1786abc15

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5E:Rh+ZkldDPK8YaKjE

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks