General

  • Target

    76d850fa58f96c4e85a6eba084b16538a3b6a00fe61297da336a7f12e1dbd2d4N.exe

  • Size

    952KB

  • Sample

    240925-t7dhraygka

  • MD5

    14174ab5e03b39aa6ed2116852f72a80

  • SHA1

    616364043465e65f99bd1bcf2f8151ebd47939d9

  • SHA256

    76d850fa58f96c4e85a6eba084b16538a3b6a00fe61297da336a7f12e1dbd2d4

  • SHA512

    b5e9600a03bdac8f0108dd5a1269ff7b22e20b8996ce75a17fd6a1d2e223aa3376dac5a0f3c80166b178d8021eaf194d10a25f1b5684b229df302d325e5a8bb9

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      76d850fa58f96c4e85a6eba084b16538a3b6a00fe61297da336a7f12e1dbd2d4N.exe

    • Size

      952KB

    • MD5

      14174ab5e03b39aa6ed2116852f72a80

    • SHA1

      616364043465e65f99bd1bcf2f8151ebd47939d9

    • SHA256

      76d850fa58f96c4e85a6eba084b16538a3b6a00fe61297da336a7f12e1dbd2d4

    • SHA512

      b5e9600a03bdac8f0108dd5a1269ff7b22e20b8996ce75a17fd6a1d2e223aa3376dac5a0f3c80166b178d8021eaf194d10a25f1b5684b229df302d325e5a8bb9

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5M:Rh+ZkldDPK8YaKjM

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks