Overview

overview

10

Static

static

5

a7fcc4e131...47.exe

windows7-x64

10

a7fcc4e131...47.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a7fcc4e131920ba4d359157d48c3cc3fc5145ef345c0d1a9294c8bc92457e547

  • Size

    951KB

  • Sample

    240702-b3zw3s1hnd

  • MD5

    856f8f970103ff28b3e4f5b056112486

  • SHA1

    84db42a19e42137950ed56c8f1a0619956c3d88d

  • SHA256

    a7fcc4e131920ba4d359157d48c3cc3fc5145ef345c0d1a9294c8bc92457e547

  • SHA512

    39fc6c6deb8c089072ed077f77200465948a54c161586e5037e7567bc1c446a66d90aa1ec75bf4efd3309e0290f7ce3510193463d2cb65015c3466b77de49372

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT55:Rh+ZkldDPK8YaKj5

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a7fcc4e131920ba4d359157d48c3cc3fc5145ef345c0d1a9294c8bc92457e547

    • Size

      951KB

    • MD5

      856f8f970103ff28b3e4f5b056112486

    • SHA1

      84db42a19e42137950ed56c8f1a0619956c3d88d

    • SHA256

      a7fcc4e131920ba4d359157d48c3cc3fc5145ef345c0d1a9294c8bc92457e547

    • SHA512

      39fc6c6deb8c089072ed077f77200465948a54c161586e5037e7567bc1c446a66d90aa1ec75bf4efd3309e0290f7ce3510193463d2cb65015c3466b77de49372

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT55:Rh+ZkldDPK8YaKj5

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks