Overview

overview

10

Static

static

5

bad9d609af...KI.exe

windows7-x64

10

bad9d609af...KI.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bad9d609afc0350228aee5bf753f88b0_NEIKI

  • Size

    903KB

  • Sample

    240508-qbtnbagd37

  • MD5

    bad9d609afc0350228aee5bf753f88b0

  • SHA1

    e38d474a2985d0fc3fe3879be11ca95c61189f80

  • SHA256

    77ff7f1fc88f5e016da1dfd6dd57ac599c351bf38b4f71470af80bb5d0d91d11

  • SHA512

    5f26a08774706f482e390130109d1f83de624520d02d8aaec29a50cb54714504080e0b44c241c4be6af0294463735fb07c14f1f9878b8f8fd3c2cbbae1f7dcfa

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5B:gh+ZkldoPK8YaKGB

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      bad9d609afc0350228aee5bf753f88b0_NEIKI

    • Size

      903KB

    • MD5

      bad9d609afc0350228aee5bf753f88b0

    • SHA1

      e38d474a2985d0fc3fe3879be11ca95c61189f80

    • SHA256

      77ff7f1fc88f5e016da1dfd6dd57ac599c351bf38b4f71470af80bb5d0d91d11

    • SHA512

      5f26a08774706f482e390130109d1f83de624520d02d8aaec29a50cb54714504080e0b44c241c4be6af0294463735fb07c14f1f9878b8f8fd3c2cbbae1f7dcfa

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5B:gh+ZkldoPK8YaKGB

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks