General

  • Target

    767f11fe4d47c5a41b90897794b02490N.exe

  • Size

    952KB

  • Sample

    240907-cjhzwszeqd

  • MD5

    767f11fe4d47c5a41b90897794b02490

  • SHA1

    9798a552005b1b6e216ff8b410f4a206494654ca

  • SHA256

    11c11c2d429c6d747d05f099412c6c5e79aa874f8ac9ade7168901d0e6204e1a

  • SHA512

    5e2d83fc4a8aec5ee8b20fb2f021d7ba505a13448c785cd692ff47494a8b11a4e58d47c920794a7f572c3dcacde3d5194d719b5fa15833d202f6e200139bd5e1

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      767f11fe4d47c5a41b90897794b02490N.exe

    • Size

      952KB

    • MD5

      767f11fe4d47c5a41b90897794b02490

    • SHA1

      9798a552005b1b6e216ff8b410f4a206494654ca

    • SHA256

      11c11c2d429c6d747d05f099412c6c5e79aa874f8ac9ade7168901d0e6204e1a

    • SHA512

      5e2d83fc4a8aec5ee8b20fb2f021d7ba505a13448c785cd692ff47494a8b11a4e58d47c920794a7f572c3dcacde3d5194d719b5fa15833d202f6e200139bd5e1

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks