General

  • Target

    b0939e48b8e6ba4fcd885613439554e0N.exe

  • Size

    952KB

  • Sample

    240906-ldgdjsyfkg

  • MD5

    b0939e48b8e6ba4fcd885613439554e0

  • SHA1

    46a9eff8d48b4ee92bc196c6364f91016ad682ba

  • SHA256

    9f099558ed0f3bd66cba08d88e10cceeafce1731f497198bd795c7e8028fb959

  • SHA512

    25816a7878229bc72ab30c245111806486d5050268f6788487de149933430b0e2ed70fe7ee8c9b63a9fe55cc71f2259af11a16bcc18826747f531773de2a25cc

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5Z:Rh+ZkldDPK8YaKjZ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b0939e48b8e6ba4fcd885613439554e0N.exe

    • Size

      952KB

    • MD5

      b0939e48b8e6ba4fcd885613439554e0

    • SHA1

      46a9eff8d48b4ee92bc196c6364f91016ad682ba

    • SHA256

      9f099558ed0f3bd66cba08d88e10cceeafce1731f497198bd795c7e8028fb959

    • SHA512

      25816a7878229bc72ab30c245111806486d5050268f6788487de149933430b0e2ed70fe7ee8c9b63a9fe55cc71f2259af11a16bcc18826747f531773de2a25cc

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5Z:Rh+ZkldDPK8YaKjZ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks