General

  • Target

    05f4168156057bde0277b3ce5154cf30N.exe

  • Size

    952KB

  • Sample

    240915-ad32rsvdmd

  • MD5

    05f4168156057bde0277b3ce5154cf30

  • SHA1

    6b35bf328f69dd056484e11d725fb25c23996a41

  • SHA256

    7e312cd8808b77f40231ccd8b213ac0d6b20048e95ab54edbd080a849ea62546

  • SHA512

    86d36cacb07164174415d0fb28edcb5252b258200dec7506a67f9333b3cc75bdf6cf029831d982fdbdb50ef429cf34d3002e80a6be89f2138f4591bcc9bcecd5

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5v:Rh+ZkldDPK8YaKjv

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      05f4168156057bde0277b3ce5154cf30N.exe

    • Size

      952KB

    • MD5

      05f4168156057bde0277b3ce5154cf30

    • SHA1

      6b35bf328f69dd056484e11d725fb25c23996a41

    • SHA256

      7e312cd8808b77f40231ccd8b213ac0d6b20048e95ab54edbd080a849ea62546

    • SHA512

      86d36cacb07164174415d0fb28edcb5252b258200dec7506a67f9333b3cc75bdf6cf029831d982fdbdb50ef429cf34d3002e80a6be89f2138f4591bcc9bcecd5

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5v:Rh+ZkldDPK8YaKjv

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks