General

  • Target

    9f7e3e8ed0393047d282a808d92aedd21445e30e04c08e78621668a6f201f1e8N.exe

  • Size

    904KB

  • Sample

    241205-q821ysxmat

  • MD5

    76de9638aeae432da73071ac90819b40

  • SHA1

    6838b70154af060b148b2f60d204b7f94a7a87cb

  • SHA256

    9f7e3e8ed0393047d282a808d92aedd21445e30e04c08e78621668a6f201f1e8

  • SHA512

    77a993e490e5b07edaaa108ade74cc088beb7a03e06877a05b4db1b986b366ee27f92a6aa891dcc1d47a1d713b2fe0792f4d7da27b134d54d2f9ff10ccf314a7

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      9f7e3e8ed0393047d282a808d92aedd21445e30e04c08e78621668a6f201f1e8N.exe

    • Size

      904KB

    • MD5

      76de9638aeae432da73071ac90819b40

    • SHA1

      6838b70154af060b148b2f60d204b7f94a7a87cb

    • SHA256

      9f7e3e8ed0393047d282a808d92aedd21445e30e04c08e78621668a6f201f1e8

    • SHA512

      77a993e490e5b07edaaa108ade74cc088beb7a03e06877a05b4db1b986b366ee27f92a6aa891dcc1d47a1d713b2fe0792f4d7da27b134d54d2f9ff10ccf314a7

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5q:gh+ZkldoPK8YaKGq

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Revengerat family

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks