Overview

overview

10

Static

static

5

559a1f4bdc...28.exe

windows7-x64

10

559a1f4bdc...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    559a1f4bdcac6914cdd61fb25d0418922be6246d6744642924a82f8358c4b128

  • Size

    951KB

  • Sample

    240629-1b2n2azfjn

  • MD5

    aac184338b4f7ae747688b212fc55866

  • SHA1

    a514eafb70e3f7d556db660cc8b45af628ad03c7

  • SHA256

    559a1f4bdcac6914cdd61fb25d0418922be6246d6744642924a82f8358c4b128

  • SHA512

    2c746a205f6727ee837e0d6ae697cdec0830346d2584f9e88d5c8176f4e1886f443a2b7e0fe038980e529b6962b4d8a33cbec55112eba207c4fd0b5fdda3fb62

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      559a1f4bdcac6914cdd61fb25d0418922be6246d6744642924a82f8358c4b128

    • Size

      951KB

    • MD5

      aac184338b4f7ae747688b212fc55866

    • SHA1

      a514eafb70e3f7d556db660cc8b45af628ad03c7

    • SHA256

      559a1f4bdcac6914cdd61fb25d0418922be6246d6744642924a82f8358c4b128

    • SHA512

      2c746a205f6727ee837e0d6ae697cdec0830346d2584f9e88d5c8176f4e1886f443a2b7e0fe038980e529b6962b4d8a33cbec55112eba207c4fd0b5fdda3fb62

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5z:Rh+ZkldDPK8YaKjz

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks