General

  • Target

    88da5f66993d40668fb04f7d8abcaec0N.exe

  • Size

    952KB

  • Sample

    240915-mcap2sydjd

  • MD5

    88da5f66993d40668fb04f7d8abcaec0

  • SHA1

    2f4cf83ed0ef111272c0c04a746738f009c02f8d

  • SHA256

    5e86d9f7760b22b8c81859b7e0af72cdcb17f14c16c6ca258b124cdc35e6d2e4

  • SHA512

    3b92d67b13309da87e49f84b530fea6ef5f3f92420f01b47534eb673c84f8b38e7634260d136f364f8e683d7eed5d4a1346198b0ed716f0ef4219e200d7b3942

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5S:Rh+ZkldDPK8YaKjS

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      88da5f66993d40668fb04f7d8abcaec0N.exe

    • Size

      952KB

    • MD5

      88da5f66993d40668fb04f7d8abcaec0

    • SHA1

      2f4cf83ed0ef111272c0c04a746738f009c02f8d

    • SHA256

      5e86d9f7760b22b8c81859b7e0af72cdcb17f14c16c6ca258b124cdc35e6d2e4

    • SHA512

      3b92d67b13309da87e49f84b530fea6ef5f3f92420f01b47534eb673c84f8b38e7634260d136f364f8e683d7eed5d4a1346198b0ed716f0ef4219e200d7b3942

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5S:Rh+ZkldDPK8YaKjS

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks