General

  • Target

    01a644d9f5e870ccc99d4a54fe6fb420N.exe

  • Size

    952KB

  • Sample

    240905-k3xamaxakp

  • MD5

    01a644d9f5e870ccc99d4a54fe6fb420

  • SHA1

    2e13636edd2278aad47c15f14b91832cfe7735d4

  • SHA256

    f00549f644df651ecac7ff553a9f4966ee1e6b3078e44750b5c7c1a907a16bd0

  • SHA512

    0defae41638aeabae1998b7a3051347f0804b484a279444928b34a4188638e9f7cda3f586ffdf9b6f3ef7a354cf30d7eaa255d7783f9908976a752d8c31d32ec

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5k:Rh+ZkldDPK8YaKjk

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      01a644d9f5e870ccc99d4a54fe6fb420N.exe

    • Size

      952KB

    • MD5

      01a644d9f5e870ccc99d4a54fe6fb420

    • SHA1

      2e13636edd2278aad47c15f14b91832cfe7735d4

    • SHA256

      f00549f644df651ecac7ff553a9f4966ee1e6b3078e44750b5c7c1a907a16bd0

    • SHA512

      0defae41638aeabae1998b7a3051347f0804b484a279444928b34a4188638e9f7cda3f586ffdf9b6f3ef7a354cf30d7eaa255d7783f9908976a752d8c31d32ec

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5k:Rh+ZkldDPK8YaKjk

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks