General

  • Target

    70fa7d953325a01e4159241086ae415e7786b431063916e642142bf70fcd9a52N.exe

  • Size

    952KB

  • Sample

    241129-g3ffbszpcv

  • MD5

    54079c9b93c5d898287eeaaae1bbbdb0

  • SHA1

    c87a7b3553d5691e779c258ca86360c1d1b9605e

  • SHA256

    70fa7d953325a01e4159241086ae415e7786b431063916e642142bf70fcd9a52

  • SHA512

    74a0079d84ceb4f05d351b498012d936e267e1cb84cfb562d06c2e4f68df1d614481e92f11c40e110af3b51dc3623a83622455f5da02dea0355d5301b7134a32

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      70fa7d953325a01e4159241086ae415e7786b431063916e642142bf70fcd9a52N.exe

    • Size

      952KB

    • MD5

      54079c9b93c5d898287eeaaae1bbbdb0

    • SHA1

      c87a7b3553d5691e779c258ca86360c1d1b9605e

    • SHA256

      70fa7d953325a01e4159241086ae415e7786b431063916e642142bf70fcd9a52

    • SHA512

      74a0079d84ceb4f05d351b498012d936e267e1cb84cfb562d06c2e4f68df1d614481e92f11c40e110af3b51dc3623a83622455f5da02dea0355d5301b7134a32

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks