General

  • Target

    1cc71f29e6c89275d17373f27730cc3e2f92b79975c38fa92b17e2b212c685f5N.exe

  • Size

    952KB

  • Sample

    241202-yldnvazlbx

  • MD5

    343ff4a25a6f2bda863514fdd400c8d0

  • SHA1

    5250dd907b6c320ce1a76fcf04ecff23b58b331e

  • SHA256

    1cc71f29e6c89275d17373f27730cc3e2f92b79975c38fa92b17e2b212c685f5

  • SHA512

    1bacbb164473fc862fc23c570a7f1cbfab2d55d592ea526d15ec581cf0f660828006579088451334f01c22e509fc0d1fa5029b59f333062998c138ad2f9c6666

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT56:Rh+ZkldDPK8YaKj6

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1cc71f29e6c89275d17373f27730cc3e2f92b79975c38fa92b17e2b212c685f5N.exe

    • Size

      952KB

    • MD5

      343ff4a25a6f2bda863514fdd400c8d0

    • SHA1

      5250dd907b6c320ce1a76fcf04ecff23b58b331e

    • SHA256

      1cc71f29e6c89275d17373f27730cc3e2f92b79975c38fa92b17e2b212c685f5

    • SHA512

      1bacbb164473fc862fc23c570a7f1cbfab2d55d592ea526d15ec581cf0f660828006579088451334f01c22e509fc0d1fa5029b59f333062998c138ad2f9c6666

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT56:Rh+ZkldDPK8YaKj6

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks