General

  • Target

    f361f84675b0774902cb47073746807007898756cbaecff9fabdce7d2f148829.exe

  • Size

    952KB

  • Sample

    241204-kbtenavlbq

  • MD5

    9347a2e5733acc897af40039a6fa3b12

  • SHA1

    bd785baaa44b741915ea6945f650d2a4ef246664

  • SHA256

    f361f84675b0774902cb47073746807007898756cbaecff9fabdce7d2f148829

  • SHA512

    358e94ad1a6164d0d200286f889e142ce3a41d9f240abbe61dd22a35976a1c6551470db7c8b728de7d8c044208b50049f9c5f044784b97d31656b61828e805bf

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5K:Rh+ZkldDPK8YaKjK

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      f361f84675b0774902cb47073746807007898756cbaecff9fabdce7d2f148829.exe

    • Size

      952KB

    • MD5

      9347a2e5733acc897af40039a6fa3b12

    • SHA1

      bd785baaa44b741915ea6945f650d2a4ef246664

    • SHA256

      f361f84675b0774902cb47073746807007898756cbaecff9fabdce7d2f148829

    • SHA512

      358e94ad1a6164d0d200286f889e142ce3a41d9f240abbe61dd22a35976a1c6551470db7c8b728de7d8c044208b50049f9c5f044784b97d31656b61828e805bf

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5K:Rh+ZkldDPK8YaKjK

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks