General

  • Target

    958639d15edc0b36c2ce2c8e57fc6b00_NEIKI

  • Size

    951KB

  • Sample

    240508-ny59hsba5x

  • MD5

    958639d15edc0b36c2ce2c8e57fc6b00

  • SHA1

    37ce840c1680232521bffa59d01dbc1f4e3696cc

  • SHA256

    e5831880bb41e19c5eba1d03341f160fcc2941e01a9aebb58d3cfa4cefaa5315

  • SHA512

    a75f4f539773464cab6ac7f565aae4b32ac33f3e8e51484ab1225d25102d469389942e66fb6867b6b2d89bfb2436a6086c0a8dd44b855c89e74e9c2a1e45beed

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      958639d15edc0b36c2ce2c8e57fc6b00_NEIKI

    • Size

      951KB

    • MD5

      958639d15edc0b36c2ce2c8e57fc6b00

    • SHA1

      37ce840c1680232521bffa59d01dbc1f4e3696cc

    • SHA256

      e5831880bb41e19c5eba1d03341f160fcc2941e01a9aebb58d3cfa4cefaa5315

    • SHA512

      a75f4f539773464cab6ac7f565aae4b32ac33f3e8e51484ab1225d25102d469389942e66fb6867b6b2d89bfb2436a6086c0a8dd44b855c89e74e9c2a1e45beed

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5p:Rh+ZkldDPK8YaKjp

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks