General

  • Target

    c3f304e4b3ad5cdce2e7bac2740c7da61d74103f08462baff18632569daa0fa7N.exe

  • Size

    952KB

  • Sample

    240925-kgwrzaycqh

  • MD5

    99d2ac6827fab16eb7f6b2a730944850

  • SHA1

    c9e6659ee393971b1acd0e389c194f687595d069

  • SHA256

    c3f304e4b3ad5cdce2e7bac2740c7da61d74103f08462baff18632569daa0fa7

  • SHA512

    7fa2c19e4f47d1cd53e9d7a8e0e87f6d112672a4877eeb32fec2fb8aa8e564f0f8117bb2d4a2e26da57dbaaab967eedef0468af8fbf1759a9f36bf2c508bc0a6

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5F:Rh+ZkldDPK8YaKjF

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      c3f304e4b3ad5cdce2e7bac2740c7da61d74103f08462baff18632569daa0fa7N.exe

    • Size

      952KB

    • MD5

      99d2ac6827fab16eb7f6b2a730944850

    • SHA1

      c9e6659ee393971b1acd0e389c194f687595d069

    • SHA256

      c3f304e4b3ad5cdce2e7bac2740c7da61d74103f08462baff18632569daa0fa7

    • SHA512

      7fa2c19e4f47d1cd53e9d7a8e0e87f6d112672a4877eeb32fec2fb8aa8e564f0f8117bb2d4a2e26da57dbaaab967eedef0468af8fbf1759a9f36bf2c508bc0a6

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5F:Rh+ZkldDPK8YaKjF

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks